Hazard and Risk Assessment

99  Download (0)

Full text

(1)

C2 Kurnell Buncefield Review

Hazard and Risk Assessment

C1 Preliminary Hazard Analysis

(2)
(3)

R4Risk Pty Ltd

ACN 134 478 050

15 Yarra Street (PO Box 5023)

South Melbourne VIC 3205 P: 03 9268 9700

F: 03 8678 0650

E: solutions@r4risk.com.au www.r4risk.com.au

Proposed Kurnell Product Terminal

Preliminary Hazard Analysis

15 May 2013

(4)

Confidential and Sensitive Document

Exempt from disclosure under the Government Information (Public Access) Act 2009 (NSW)

The complete Preliminary Hazard Analysis Report is provided to the NSW Department of Planning & Infrastructure (“DP&I”) by Caltex Refineries (NSW) Pty Ltd (“Caltex”) in confidence for use only within DP&I. It is submitted on the basis that there is an overriding public interest against disclosure pursuant to section 14(2) of the Government Information (Public Access) Act 2009 (NSW) (the “Act”). The Report is exempt from disclosure under the Act on the grounds that it contains information associated with the storage of security sensitive petroleum finished product and information that is commercial-in-confidence.

The information which is exempt from disclosure applies specifically to the following parts of the Report:

 Appendix E Lists of Hazardous Scenarios

(5)

DOCUMENT CONTROL

Project Title Proposed Kurnell Product Terminal - Preliminary Hazard Analysis

Client Name Caltex Refineries (NSW) Pty Ltd

Project No. 107-24

Project Manager Patrick Walker Report Author (s) Patrick Walker

Release Issue Date Reviewed by Approved by Comments

Release 1 27 February 2013 L. Dreher L. Dreher Issued to Client

Release 2 18 April 2013 L. Dreher L. Dreher Revised with Client

comments

Release 3 26 April 2013 L. Dreher L. Dreher Updated

Release 4 8 May 2013 L. Dreher L. Dreher Updated

(6)

Table of Contents

1 EXECUTIVE SUMMARY... 6

1.1 Major Risk Contributors ... 6

1.2 Individual Risk - Fatality... 7

1.3 Individual Risk - Injury ... 7

1.4 Societal Risk - Off-site ... 7

1.5 Risk of Property Damage and Accident Propagation ... 8

1.6 Biophysical Risk ... 8

1.7 Assumptions And Sensitivity ... 9

1.8 Related Safety Studies ... 9

1.9 Findings And Recommendations... 9

2 ACRONYMS & GLOSSARY... 10

2.1 Acronyms... 10 2.2 Glossary... 10 3 INTRODUCTION ... 12 3.1 Background... 12 3.2 The Project ... 12 3.2.1 Scope... 12 3.2.2 Aim... 12

3.3 The Preliminary Hazard Analysis ... 12

3.3.1 Scope... 12

3.3.2 Aim... 13

4 SITE & PROJECT DESCRIPTION... 14

4.1 Project Location ... 14

4.2 Project Description ... 14

4.2.1 Wharf Operation ... 14

4.2.2 Tank Farm Operation ... 14

4.2.3 Associated Pipelines and Pumps ... 14

5 METHODOLOGY ... 17 5.1 Hazard Identification ... 18 5.1.1 Data Collection ... 18 5.1.2 Scenario Development ... 19 5.2 Frequency Assessment ... 19 5.2.1 Scenario Frequency ... 19

5.2.2 Event Tree Analysis... 19

5.3 Consequence Assessment... 19

(7)

5.3.2 Vapour Cloud Explosions ... 20

5.3.3 Vulnerability Models ... 20

5.4 Risk Assessment ... 20

5.5 Study Assumptions ... 20

6 RISK CRITERIA ... 21

6.1 Individual Risk - Fatality... 21

6.2 Individual Risk - Injury ... 21

6.3 Societal Risk Criteria ... 21

6.4 Risk of Property Damage and Accident Propagation ... 22

6.5 Biophysical Risk ... 22 7 HAZARD IDENTIFICATION ... 23 7.1 Hazardous Materials... 23 7.2 Isolatable Sections ... 23 7.3 Hazardous Scenarios ... 23 7.4 Consequence Events ... 24 7.4.1 Pool Fires... 24

7.4.2 Vapour Cloud Explosion ... 25

7.5 Major Accident Hazards ... 25

8 FREQUENCY ASSESSMENT ... 27

8.1 Failure Frequency... 27

8.2 Event Tree Analysis... 27

8.3 Tank Overfill / Explosion Frequency... 28

9 CONSEQUENCE ANALYSIS... 30

10 RISK ASSESSMENT... 32

10.1 Individual Risk - Fatality... 32

10.2 Individual Risk - Injury ... 35

10.3 Societal Risk – Off-site Population ... 37

10.4 Risk of Property Damage and Accident Propagation ... 37

10.5 Biophysical Risk ... 39

10.6 Sensitivity Analysis ... 40

11 COMPARISON TO RISK AT THE EXISTING FACILITY ... 41

12 REFERENCES ... 42

Appendix A Assumption Register

Appendix B Failure Rate Data

Appendix C Buncefield Recommendations

Appendix D Off-site Population Data

Appendix E Lists of Hazardous Scenarios

(8)

1

EXECUTIVE SUMMARY

Caltex is seeking development approval to convert the existing Kurnell Refinery into a Finished Product Terminal (the ‘Project’). In accordance with the NSW Department of Planning and Infrastructure (DP&I) Director-General’s Requirements (DGRs) for the Development, a Preliminary Hazard Analysis (PHA) Report was prepared by R4Risk for inclusion in the Environment Impact Statement (EIS) for SSD-5544.

The PHA report was prepared with reference to the State Environment Planning Policy No 33 -Hazardous and Offensive Development [1], and in accordance with the NSW DP&I’s -Hazardous Industry Planning Advisory Papers No. 4 - Risk Criteria (HIPAP4) [2] and No. 6 - Hazard Analysis (HIPAP6) [3].

The Project comprises the following principal components:

 Continued use of parts of the existing refinery, in a manner similar to that currently in place, for the storage and distribution of petroleum products.

 A number of existing crude oil tanks are to be cleaned and modified to allow for the storage of refined product (i.e. conversion to finished product tanks).

 A small number of other tanks already storing one type of refined product are to be converted to store alternative products.

 New pumps, pipes and electrical infrastructure are to be installed within the Project Area (defined in Section 4.1).

 A range of ancillary works is also to be undertaken to improve efficiency and to facilitate the conversion of the refinery into a terminal. These ancillary works include consolidation and upgrades to the utilities, transportation and management systems at the site.

The refinery plant would also be shut down, depressurised, de-inventoried and left in situ. Caltex shut down, depressurise and de-inventory the refinery plant during routine maintenance activities as part of the existing operation and therefore this action does not form part of the Project.

The Project is expected to be undertaken over a 54 month period.

In preparing the PHA Report, R4Risk has investigated the risk of operations associated with the following areas:

 Tank farm operations

 Wharf operations associated with fixed shore assets (i.e. excluding shipping activities); and

 Associated pipelines and pumps.

The quantitative risk assessment (QRA) methodology was used to determine the risk profile for the Project. The methodology involved the following key steps:

 Hazard Identification

 Consequence Assessment

 Frequency Assessment

 Risk Assessment.

The tolerability of the calculated risk was assessed by comparison with the risk criteria specified in HIPAP4 [2]. The following sections summarise the major findings from the risk assessment. The corresponding risk contours are presented in Section 10.

1.1 MAJOR RISK CONTRIBUTORS

The PHA examined scenarios associated with the Major Accident Hazards (MAHs) that involved the loss of containment of flammable (gasoline, jet fuel, slops) or combustible (diesel) material. The study considered the material that could be released from storage tanks, pumps and loading arms, as well as the associated pipelines. The QRA determined the potential that released material would ignite, resulting in a pool fire. The study also evaluated the frequency and potential consequence of a

(9)

Buncefield-type vapour cloud explosion (VCE). Although assessed as extremely unlikely, the Buncefield-type VCE event was included in the QRA.

1.2 INDIVIDUAL RISK - FATALITY

Location-specific individual risk (LSIR) contours for the risk of fatality were developed. These were used to assess the tolerability of the risk against the risk criteria described in HIPAP4. As each of the risk contours do not extend into the respective land-use areas to which the criteria are applied, the off-site fatality risk criteria are therefore satisfied. This is summarised in Table 1.

Table 1: LSIR Fatality Risk Tolerance Criteria [2]

Land Use

Tolerance Criteria (risk in a million per

year)

LSIR Results

Sensitive areas, such as hospitals and schools 0.5

The relevant LSIR

contours do not

extend to each of

these areas.

All criteria are

satisfied.

Residential developments and continuous

occupancy, such as hotels and resorts 1.0

Commercial developments, including retail

centres, offices and entertainment centres 5

Sporting complexes and active open space 10

Industrial areas 50

1.3 INDIVIDUAL RISK - INJURY

Location-specific individual risk (LSIR) contours for the risk of injury were developed. The tolerability of the injury risk results was determined by comparison with the HIPAP4 injury risk criteria. Similar to the fatality risk contours, the injury risk contours do not extend into the respective land-use areas to which the criteria are applied. The injury risk criteria are therefore satisfied. This is summarised in Table 2.

Table 2: LSIR Injury Risk Tolerance Criteria [2]

Individual Injury Risk Criteria

Tolerance Criteria (risk in a million per

year)

LSIR Results

Incident heat flux radiation at residential and

sensitive areas exceeding 4.7 kW/m2. 50 The relevant LSIR

contours do not

extend to these areas. The criteria is met. Incident explosion overpressure at residential and

sensitive use areas should not exceed 7 kPa at frequencies.

50 Toxic concentrations in residential and sensitive

use areas exceed a level which would be seriously injurious to sensitive members of the community following a relatively short period of exposure.

10

Not applicable, as the QRA did not involve scenarios which could result in this type of event.

1.4 SOCIETAL RISK - OFF-SITE

The societal risk “F-N curve” was developed. This considered potential impacts on the off-site population. The tolerability of the risk was assessed using the “indicative societal risk criteria” described in HIPAP4 [2]. The societal risk assessment, compared against these criteria, is presented in Figure 1.

The societal risk “F-N curve” for the proposed operations lies fully below the “negligible” line. In this region, the societal risk is not considered significant, provided other individual risk criteria are met. As described in the preceding sections, the individual risk criteria for fatality and injury are satisfied. Therefore the societal risk is also considered to be tolerable.

(10)

Figure 1: Societal Risk Results – Off-site Population

1.5 RISK OF PROPERTY DAMAGE AND ACCIDENT PROPAGATION

Location-specific risk contours were developed to represent the risk of property damage and accident propagation. The tolerability of the results was determined by comparison with corresponding risk criteria outlined in HIPAP4. The risk contours do not extend to off-site areas. The risk criteria are therefore satisfied. This is summarised in Table 3.

Table 3: Risk of Property Damage And Accident Propagation Tolerance Criteria [2]

Risk Criteria

Tolerance Criteria (risk in a million per

year)

LSIR Results

Incident heat flux radiation at neighbouring potentially hazardous installations or at

land zoned to accommodate such

installations for the 23 kW/m2heat flux.

50

The relevant LSIR contours do not extend to these areas. The criteria are met.

Incident explosion overpressure at

neighbouring potentially hazardous

installations, at land zoned to

accommodate such installations or at nearest public buildings for the 14 kPa explosion overpressure level

50

1.6 BIOPHYSICAL RISK

The risk to the biophysical environment was assessed by examining the potential for identified release scenarios to impact on the long-term viability of the surrounding ecosystems. For different sections of the facility, the assessment considered the key controls that would prevent, or mitigate, the impact of a release. The analysis demonstrated controls would be in place that would either minimise the potential for a release or contain product if a release did occur. Therefore, a release of product from the terminal would not pose a threat to the long-term viability of the ecosystem.

1.00E-09 1.00E-08 1.00E-07 1.00E-06 1.00E-05 1.00E-04 1.00E-03 1.00E-02 1.00E-01 1 10 100 1000 F re q u e n c y o f N o r m o re f a ta li ti e s ( F , /y e a r) Number of Fatalities (N)

Intolerable

Negligible

ALARP

(11)

1.7 ASSUMPTIONS AND SENSITIVITY

In completing the QRA, a number of technical assumptions were made. These assumptions are described in Appendix A. For key assumptions, details of the applied methodology and corresponding references are also included.

To support the risk assessment conclusions, a review was conducted to determine the sensitivity of the QRA results to key parameters. The review examined the parameters such as failure frequency and the radiant heat vulnerability model. This review showed that the risk tolerability remained unchanged, despite the modifications made. Details of the sensitivity analysis are provided in Section 10.6.

1.8 RELATED SAFETY STUDIES

In conducting the PHA, R4Risk reviewed, or were provide access to, a number of detailed studies conducted for the Kurnell site. These included the following studies:

 Process Hazard Analysis for the Terminal Conversion and the Caltex Port and Marine Works

Project

 Major Hazard Facility Safety Report for the Kurnell Refinery

 Kurnell Peninsula Land Use Safety Study 2007

 Various historical fire safety studies examining the refinery operations and the proposed terminal

 Caltex review of Buncefield Report Recommendations.

1.9 FINDINGS AND RECOMMENDATIONS

This quantitative risk assessment demonstrates that the risk levels calculated for the Project satisfy the risk criteria specified in HIPAP4. Compared with existing refinery operations, the off-site risk profile is considerably reduced. This outcome is expected, because the Project involves a downscaling of the existing operations, i.e. a reduction in the scale and complexity of the operations at the site.

The studies listed in Section 1.8 provided input into the development of the design for the proposed terminal. Caltex has identified risk reduction recommendations using its Riskman2 methodology. These are documented in the detailed process hazard analysis records and are tracked to completion by Caltex’s project management process.

(12)

2

ACRONYMS & GLOSSARY

2.1 ACRONYMS

ALARP As low as reasonably practicable

BLEVE Boiling-liquid expanding-vapour explosion

Caltex Caltex Refineries (NSW) Pty Ltd

CCTV Closed-circuit television

DCS Distributed control system

DGRs Director-General’s Requirements

DP&I Department of Planning and Infrastructure

EIS Environment impact statement

ESDV Emergency shutdown valve

HES Health, environment, safety

HIPAP4 New South Wales Department of Planning Hazardous Industry Planning

Advisory Paper No. 4 [2]

HIPAP6 New South Wales Department of Planning Hazardous Industry Planning

Advisory Paper No. 6 [3]

HSE Health & Safety Executive (United Kingdom)

IR Individual risk

IRPA Individual risk per annum

Loc. Loss of containment

LPG Liquefied petroleum gas

LSIR Location-specific individual risk

MAH Major Accident Hazard

MOV Motor-operated valve

MSDS Material safety data sheet

OWS Oily Water Sewer

P&ID Piping and instrumentation diagram

PFD Probability of failure on demand

PHA Preliminary hazard analysis

PULP Premium unleaded petrol

QRA Quantitative risk assessment

SSD Significant State Development

SPULP Super-premium unleaded petrol

VCE Vapour cloud explosion

ULP Unleaded petrol

2.2 GLOSSARY

Consequence The severity associated with an event in this instance the heat radiation from

the pool fire events, i.e. the potential effects of a hazardous event.

Consequence Event The end event associated with a failure and release, considering all detection, isolation and ignition factors, e.g. pool fire, flash fire etc.

Eastern Tank Area

The Eastern Tank Area contains existing finished product tanks, some of which would need minor conversion works as part of the Project. It also contains the Oil Movements Centre (OMC).

Event Frequency The frequency assigned to a specific consequence event

Frequency The number of occurrences of an event expressed per unit time. It is usually

expressed as the likelihood of an event occurring per annum.

Hazard A physical situation with the potential for human injury, damage to property,

damage to the environment or some combination of these.

Hazardous Scenario The accidental release of a hazardous material from equipment or piping, from identified isolatable section of terminal operation.

(13)

Individual Risk (IR) The frequency at which an individual may be expected to sustain a given level of harm from the realisation of specified hazards.

Individual Risk Contours

As individual risk (IR) is calculated at a point, calculating the IR at many points allows the plotting of IR contours, these being lines that indicate constant levels of risk. Most commonly used are the 1 chance per million-year contour and the 10 chances per million-million-year contour.

Individual Risk of Fatality

Individual risk, with “harm” measured in terms of fatality. It is calculated at a particular point for a stationary, unprotected person for 24 hours per day, 365 days per year. Commonly expressed in chances of fatality per million years. Isolatable Section

A system of pipes or vessels containing the hazardous materials that are bounded by specific isolation points, which can be operated to isolate the inventory in the event of an emergency.

Probability

The expression for the likelihood of an occurrence of an event or an event sequence or the likelihood of the success or failure of an event on test or demand. By definition, probability must be expressed as a number between 0 and 1.

Quantitative Risk Assessment

A risk assessment undertaken by combining quantitative evaluations of event frequency and consequence.

Risk The combination of frequency and consequences, the chance of an event

happening that can cause specific consequences.

RiskMan2

Caltex’s standard process for health, environment, safety (HES) and asset related risk management. RiskMan2 provides a standardised and systematic approach to the identification of hazards, assessment of risk and effective adoption and maintenance of control measures for HES and certain asset risks.

Western Tank Area

The Western Tank Area is primarily made up of the existing Crude Oil Tanks and the Waste Water Treatment Plant. All the Crude Oil Tanks would require conversion as part of the Project. It is proposed that the area would also include the new product pumps area and the new slops pumps area.

(14)

3

INTRODUCTION

3.1 BACKGROUND

Caltex is seeking development approval to convert the existing Kurnell Refinery into a Finished Product Terminal (the ‘Project’). In accordance with the NSW DP&I DGRs for the Development, a PHA report was prepared by R4Risk for inclusion in the EIS for SSD-5544.

The PHA report was prepared with reference to the State Environment Planning Policy No 33 -Hazardous and Offensive Development [1], and in accordance with the NSW DP&I’s -Hazardous Industry Planning Advisory Papers No. 4 - Risk Criteria [2] and No. 6 - Hazard Analysis [3]. The experience and qualifications of the project team are included in Appendix E.

This report details the methodology and presents the off-site risk profile for the proposed operations. The tolerability of the results has been assessed by comparison with the risk criteria specified in HIPAP4 [2].

3.2 THE PROJECT 3.2.1 Scope

The Project comprises the following principal components:

 Continued use of parts of the existing refinery, in a manner similar to that currently in place, for the storage and distribution of petroleum products.

 A number of existing crude oil tanks are to be cleaned and modified to allow for the storage of refined product (i.e. conversion to finished product tanks).

 A small number of other tanks already storing one type of refined product are to be converted to store alternative products.

 New pumps, pipes and electrical infrastructure are to be installed within the Project Area (defined in Section 4.1).

 A range of ancillary works are also to be undertaken to improve efficiency and to facilitate the conversion of the refinery into a terminal. These ancillary works include consolidation and upgrades to the utilities, transportation and management systems at the site.

The refinery plant would also be shut down, depressurised, de-inventoried and left in situ. Caltex shut down, depressurise and de-inventory the refinery plant during routine maintenance activities as part of the existing operation and therefore this action does not form part of the Project.

The Project is expected to be undertaken over a 54 month period.

3.2.2 Aim

The aim of the Project is to allow the site to be utilised as a terminal where finished products would be received by ship, stored in tanks and leave the site, predominantly by pipeline, to the Caltex Banksmeadow Terminal, Silverwater Terminal, Joint User Facility at Sydney Airport, or to the Caltex Newcastle Terminal via the Newcastle Pipeline.

The current capability for outloading via the wharf is to be retained, but would be used infrequently. Under typical operations, road transport of products from the site would cease. However, in exceptional circumstances, some road transport of product may be required.

3.3 THE PRELIMINARY HAZARD ANALYSIS 3.3.1 Scope

This PHA has identified and assessed hazards and risks associated with the following operational areas of the proposed development:

 Tank farm operations;

 Wharf operations associated with fixed shore assets (i.e. excluding shipping activities); and

(15)

3.3.2 Aim

The aim of the PHA is to:

 Provide an assessment of the hazards and risks associated with the proposed works; and

 Evaluate the calculated risk levels against the land-use planning criteria for off-site risk (as specified in HIPAP4).

This aim is in accordance with the requirements of the NSW DP&I DGRs for the Project and is fully consistent with Caltex’s internal standards for the management of hazards and risks at its facilities. The risk associated with the Project has been assessed quantitatively using the generally-accepted QRA methodology.

To assess the off-site risk exposure, the following outputs were generated from the QRA model:

 Individual risk of fatality contours;

 Individual risk of injury contours;

 Societal risk “F-N curve”; and

 Risk of property damage and accident propagation.

In addition to this PHA report, Caltex has also undertaken a number of detailed internal Process Hazard Analysis studies on the proposed design. These studies represent Caltex’s collective knowledge of the nature and type of hazards associated with both existing and proposed operations. They are therefore considered an appropriate basis for the hazard identification step of this PHA.

(16)

4

SITE & PROJECT DESCRIPTION

4.1 PROJECT LOCATION

The Project Area is located at the site of the existing refinery, which is on the Kurnell Peninsula within Sutherland Shire Local Government Area, approximately 15 km south of Sydney’s CBD. The site and Project Area are illustrated in Figure 2.

A site plan showing the existing operations is presented in Figure 3. The figure also highlights the different land-uses that surround the site. There are a number of light-industrial sites located near the western boundary. To the north, there is a mixture of commercial properties and residential areas. The nearest residential areas are adjacent to the north-eastern corner of the site.

4.2 PROJECT DESCRIPTION

The Kurnell Refinery is to be converted from an operating refinery to a bulk liquid fuel terminal, storing flammable and combustible liquids. The operations at Kurnell will be limited to wharf operations, tank farm storage and associated pipelines and pumps for transfers of the fuels. The following sections summarise the proposed operations at the facility.

4.2.1 Wharf Operation

Gasoline, jet fuel and fuel oil will be received by ship at the fixed berths of Kurnell Wharf. These fuels will be then transferred to the terminal via two loading arms and associated pipelines. Receipt of diesel will involve similar operations, however, it may also be received at the submarine berth. Slop produced during terminal operations will be transferred to the wharf for loading onto ships.

A separate Development Application, EIS and Preliminary Hazard Analysis Report have been produced addressing the hazards and risks associated with dredging, demolition and construction activities, as well as those associated with operational activities due to the mooring of larger ships at Kurnell Wharf (refer SSD-5353).

4.2.2 Tank Farm Operation

The flammable and combustible liquids received from the wharf are to be stored in the atmospheric storage tanks of the tank farm. The Project will involve the continued use of parts of the existing refinery plot, in a manner similar to that currently in place, for the storage and distribution of petroleum products. A number of existing crude oil tanks would be cleaned and modified to allow for the storage of refined product (i.e. conversion to finished product tanks). A small number of other tanks already storing one type of refined product would be converted to store another refined product.

4.2.3 Associated Pipelines and Pumps

The flammable and combustible liquids unloaded at the wharf will be transferred via pipeline to storage tanks within the tank farm. When required, these products will then be pumped via pipelines from the storage tanks to the Banksmeadow Terminal for further distribution. These existing pipelines run from the tank farm, out along the wharf before travelling beneath Botany Bay to Banksmeadow. Lastly, slop will be pumped out to a fixed berth at the wharf, via a combination of new and existing lines (referred to as “Slop Lines”).

(17)

Figure 2: Location of Site and Project Area

Site Project Area

(18)
(19)

5

METHODOLOGY

The methodology for conducting a PHA is well established in Australia. This assessment was carried out as per the guidelines provided within HIPAP4 and HIPAP6. Consistent with the potential for a high consequence event to occur at site, and the anticipated classification of the proposed terminal as a Major Hazard Facility, the QRA methodology was used for the purpose of off-site risk determination. The tolerability of the risk was assessed using the risk criteria specified in HIPAP4.

This section presents a summary of the QRA methodology applied to this project. The key steps in a QRA are as follows:

 Hazard Identification

 Consequence Assessment

 Frequency Assessment

 Risk Assessment.

The approach applied in this study follows these basic steps. A flow chart illustrating this approach is shown in Figure 4. Additional details on each of the steps are provided in the following sections.

(20)

Figure 4: Overview of QRA Methodology

5.1 HAZARD IDENTIFICATION 5.1.1 Data Collection

Data on the hazards at the site and details needed to complete the risk assessment were drawn from technical information on the proposed Terminal operations. This information included the following, as applicable:

 Engineering drawings (e.g. process flow diagrams, piping and instrumentation diagrams (P&IDs) etc.)

Major Accident Identification

Hazardous materials Failure modes Loss scenarios

P&IDs Flow Diagrams Emergency detection and

shutdown systems Process Information Hazard Identification Workshops Consequence Assessment Fire / Explosions Flammable vapour dispersion

Toxic vapour dispersion Impact Determination Met data Chemical data Emerg. response Plant and equipment layout Frequency Assessment

Fault Tree analysis Event Tree analysis End Event Frequency Determination

System data Failure data Ignition probabilities Detection and isolation strategies Risk Calculations Individual risk Societal risk Population data Risk Evaluation

Determine risk acceptability

Risk criteria

STOP

Acceptable Not Acceptable

Identify major risk contributors Propose risk reduction measures

(21)

 Site layout plans

 Area plans

 Major inventories of combustible, flammable and toxic substances stored / handled

 Release detection and isolation strategies and systems

 Release containment systems

 Description of surrounding land use and estimates of population densities.

5.1.2 Scenario Development

The proposed activities for the facility when in terminal operation mode were defined to identify potential hazardous scenarios. This process involved the completion of a Process Hazard Analysis study by a suitably-qualified team of Caltex personnel. The study did not identify any major accident hazards (MAHs) that were additional to those previously identified for refinery operations covering the tank farm, wharf and sub-berth operations. Conversion to terminal operations will result in a number of the previously-defined MAHs being eliminated. Terminal operations will not include liquefied gases (e.g. propane, butane) or high-temperature / high-pressure processes, such as those present within existing refinery operations. The use of liquid chlorine for biocide treatment of salt water cooling water will also be discontinued.

The identified MAH scenarios involve the release / spill of flammable or combustible liquids resulting in a fire when ignited. This could occur at various locations including storage tanks, pumps and loading arms. These hazardous scenarios were analysed in the QRA, based on the associated material properties and transfer operations. The QRA also evaluated the frequency and consequence of a Buncefield-type vapour cloud explosion.

To determine the amount of material that could potentially be involved in a release, factors such as inventory, leak detection, and leak isolation strategies were considered. Event tree models were developed for each potential release scenario. As the most likely MAH scenarios involved the release of flammable material, the main events considered in the analysis were pool fires resulting from an ignited release.

5.2 FREQUENCY ASSESSMENT

The frequency assessment involved defining the potential release sources and then determining the likelihood (frequency) of the various releases. The assessment is a two-stage process that involves evaluating the release frequency and then estimating the likelihood of the possible outcomes of the release using an event tree.

5.2.1 Scenario Frequency

The available engineering drawings for the facility were reviewed to develop a “parts count” of failure items for each of the hazardous scenarios. Failure rates based on historical industry failure frequency data were utilised to estimate the likelihood of the various hazardous scenarios. The failure rate data for storage tanks, piping, valves, and other relevant equipment items was sourced from published references and other appropriate sources. The failure rate data used in the study is presented in Appendix B.

5.2.2 Event Tree Analysis

Where appropriate, event trees were developed to estimate the frequency of the potential consequence events that may result from a given release scenario. This analysis incorporated the effectiveness of proposed detection and isolation systems when assessing consequence events that are most influenced by time.

5.3 CONSEQUENCE ASSESSMENT

Following the frequency assessment, the consequence events were identified. The potential impacts of these events were assessed using the consequence models available within PHAST-RISK [5]. These models consider the nature of the release, including the release rate, discharge velocity and duration. The models used to assess the impacts of the consequence events are outlined below.

(22)

5.3.1 Pool Fires

Pool fire impacts for bund fires, tank top fires and fires in the vicinity of pumps & pipelines were determined using a solid flame model. The model represents the flame as a skewed cylinder that radiates heat outwards. The dimensions of the skewed cylinder (flame length and flame tilt) are defined using the empirical correlations within PHAST-RISK.

5.3.2 Vapour Cloud Explosions

A vapour cloud explosion (VCE) occurs following the ignition of a flammable vapour cloud, coupled with acceleration of the flame front within the cloud. Within process areas, VCEs are typically associated with the confinement provided by surrounding equipment that promotes mixing and, subsequently, causes the flame front to accelerate.

The current analysis considered the potential for an explosion to result from a gasoline storage tank overfill event. This type of event occurred at Buncefield (United Kingdom) in 2005. Investigations into that incident concluded that the observed high levels of overpressure, and their rate of decay, are difficult to reproduce with the standard explosion models [6] (e.g. the Multi-Energy Method [7]). Therefore, the overpressure from these events was determined using information that was specifically developed to assess explosions associated with tank overfills [8].

5.3.3 Vulnerability Models

In order to evaluate the risk profile, the effects of the pool fire and VCE events must be estimated in terms of the potential to cause fatality or injury. Vulnerability models were used to correlate the impact (e.g. heat radiation) of an event to the potential for fatality or injury. The vulnerability models used in the study are described in Appendix A.

5.4 RISK ASSESSMENT

Both individual and societal risk results were generated to define the risk profile for terminal operations. These results were produced by combining the frequency and consequence estimates for each of the hazardous scenarios. The following risk measures were generated:

 “Location-specific individual risk” (LSIR) contours for fatality and injury risk

A graphical representation of “individual risk” that uses the risk values at each point to construct iso-risk contours. The contours are presented on a map showing the risk relative to the proposed terminal and surrounding land-uses.

 Societal risk “F-N curve” for off-site population

This is a “societal risk” measure that communicates the potential for hazardous scenarios to cause multiple fatalities by plotting the frequency of “N or more fatalities” (F) against the number of fatalities (N). This is presented as a graph.

Calculation of the societal risk measures requires knowledge of the population distribution surrounding the site. The following information is required for each location where people may be present (refer to Appendix D):

 Geographical location;

 Number of people present at different times of the day;

 Percentage of people located indoors; and

 Building type (if applicable).

From the individual risk results, a list of risk contributors at specific locations was determined. This allowed the major contributors to the risk to be identified, as well as the most influential hazardous scenarios. From this information, targeted risk reduction actions can be readily identified that will deliver the most effective risk reduction outcome (i.e. the greatest reduction in risk).

5.5 STUDY ASSUMPTIONS

In conducting the QRA, a number of technical assumptions were made. The key technical

(23)

6

RISK CRITERIA

The tolerability of the calculated risk is assessed by comparison with an appropriate risk target or criterion. The risk criteria used to make this assessment are specified in HIPAP4 [2]. The risk criteria are detailed below.

6.1 INDIVIDUAL RISK - FATALITY

The individual risk of fatality criteria described in HIPAP4 that are applicable to proposed hazardous developments are as follows:

 Hospitals, schools, child-care facilities and old age housing development should not be exposed to individual fatality risk levels in excess of half in one million per year (0.5 x 10-6per year).

 Residential developments and places of continuous occupancy, such as hotels and tourist resorts, should not be exposed to individual fatality risk levels in excess of one in a million per year (1 x 10-6per year).

 Commercial developments, including offices, retail centres, warehouses with showrooms, restaurants and entertainment centres, should not be exposed to individual fatality risk levels in excess of five in a million per year (5 x 10-6per year).

 Sporting complexes and active open space areas should not be exposed to individual fatality risk levels in excess of ten in a million per year (10 x 10-6per year).

 Individual fatality risk levels for industrial sites at levels of 50 in a million per year (50 x 10-6per year) should, as a target, be contained within the boundaries of the site where applicable. These criteria were developed based on a principle that if the risk from a potentially hazardous installation is less than most risks being experienced by the community (e.g. voluntary risks, transportation risks), then that risk may be tolerated. This principle is consistent with the basis of risk criteria adopted by most authorities internationally.

The criterion for residential areas is demonstrably very low in relation to the background risk. It is considered conservative, as it assumed an individual is present and exposed for 24 hours per day, 365 days per year.

6.2 INDIVIDUAL RISK - INJURY

HIPAP4 also outlines risk criteria for effects that may cause injury to people but will not necessarily cause fatality. The injury risk criteria are separated based on the different effect types, i.e., heat radiation, explosion overpressure and toxic exposure. HIPAP4 sets the following injury risk criteria:

 Heat flux radiation at residential and sensitive use areas should not exceed 4.7 kW/m2 at a frequency of more than 50 x 10-6per year.

 Explosion overpressure at residential and sensitive use areas should not exceed 7 kPa at frequencies of more than 50 x 10-6per year.

 Toxic concentrations at residential and sensitive use areas should not exceed a level which would be seriously injurious to sensitive members of the community following a relatively short period of exposure at a maximum frequency of 10 x 10-6per year.

6.3 SOCIETAL RISK CRITERIA

The NSW DP&I has adopted indicative criteria to assess the off-site societal risk. The criteria take into account the fact that society is particularly intolerant of accidents, which although infrequent, have the potential to cause multiple fatalities. The criteria are presented on the “F-N” graph in Figure 5. The criteria define three risk regions as follows [2]:

 Intolerable: above the “intolerable” line, the activity is considered undesirable, even if individual risk criteria are met.

 ALARP (“as low as reasonable practicable”): within the ALARP region, the emphasis should be on reducing risk as far as possible towards the “negligible” line (i.e. ensuring that risks have been reduced to as low as reasonably practicable). Provided other quantitative and qualitative criteria of HIPAP 4 are met, the risks from the activity may be considered tolerable within the

(24)

ALARP region as long as all “reasonably practical” risk reduction measures have been implemented.

 Negligible: below the “negligible” line the societal risk is not considered significant, provided other individual risk criteria are met.

Figure 5: Indicative Societal Risk Criteria [2]

6.4 RISK OF PROPERTY DAMAGE AND ACCIDENT PROPAGATION

HIPAP4 sets risk criteria that reflect the potential for property damage and accident propagation. Assessment against the criteria provides an indication of the risk that an accident at the facility may cause damage to buildings and / or propagate to involve neighbouring industrial operations, causing further hazardous incidents, i.e. the so-called 'domino effect'. HIPAP4 sets the following criteria for risk of damage to property and accident propagation:

 Heat flux radiation at neighbouring potentially hazardous installations, or at land zoned to accommodate such installations, should not exceed a risk of 50 x 10-6 per year for the 23 kW/m2heat flux level.

 Explosion overpressure at neighbouring potentially hazardous installations, at land zoned to accommodate such installations or at nearest public buildings should not exceed a risk of 50 x 10-6per year for the 14 kPa explosion overpressure level.

6.5 BIOPHYSICAL RISK

HIPAP4 outlines risk criteria addressing the risk from accidental releases to biophysical environment. The criteria focuses on the potential acute and chronic toxic impacts that an accidental release may have on whole systems and populations, rather than individual plants or animals. HIPAP4 expresses the criteria as follows:

 Industrial developments should not be sited in proximity to sensitive natural environmental areas where the effects (consequences) of the more likely accidental emissions may threaten the long-term viability of the ecosystem or any species within it.

 Industrial developments should not be sited in proximity to sensitive natural environmental areas where the likelihood (probability) of impacts that may threaten the long-term viability of the ecosystem or any species within it is not substantially lower than the background level of threat to the ecosystem.

1.00E-09 1.00E-08 1.00E-07 1.00E-06 1.00E-05 1.00E-04 1.00E-03 1.00E-02 1.00E-01 1 10 100 1000 F re q u e n c y o f N o r m o re f a ta li ti e s ( F , /y e a r) Number of Fatalities (N) Intolerable Negligible ALARP

(25)

7

HAZARD IDENTIFICATION

The hazard identification phase involved a review of the planned terminal operations, engineering diagrams and other relevant information. This material was used to identify all sections of the facility that would contain hazardous material during future operations.

7.1 HAZARDOUS MATERIALS

The nature of the hazardous materials identified in the study was reviewed from information contained in the Material Safety Data Sheets (MSDSs) supplied by Caltex. The materials that are to be stored on-site are:

 Gasoline (ULP / PULP / SPULP)

 Jet fuel

 Diesel

 Fuel oil

 Slop.

Slop was assumed to be a mixture of diesel and gasoline. For the purpose of this analysis, slop was assumed to have the properties of gasoline. A list of hazardous materials identified and their respective properties is presented in Table 4.

Table 4: Materials Properties [9, 10, 11, 12, 13, 14, 15] Material Name Dangerous Goods Class UN No. HAZCHEM Code Flash Point (°C) Auto-Ignition Temperature (°C) Flammability limits (in air) Gasoline 3 1203 3YE -40 370 1.4 - 7.4% Jet Fuel 3 1863 3Y 40 >210 0.7 - 6.0% Diesel C1 - - >61.5 >250 1.3 - 6.0% Fuel Oil C1 - - >61.5 - 1.0 - 5.0% 7.2 ISOLATABLE SECTIONS

Within the QRA model, the hazardous scenarios developed following a release are dependent on the conditions in the corresponding “isolatable section”. These conditions were used in the consequence modelling for each hazardous scenario and include:

 Material

 Process conditions (e.g. temperature and pressure )

 State (i.e. vapour or liquid)

 Inventory

 Flow rate

 Utilisation (i.e. percentage of the time in use).

7.3 HAZARDOUS SCENARIOS

Hazardous scenarios were developed to represent the range of possible failures associated with each isolatable section. These failure modes were represented as releases from selected hole sizes. For the wharf operations, the following two failure cases associated with the loading / unloading arms were considered:

 Full bore release – hole size equivalent to diameter of the loading arm (approximately 250 mm)

 Medium release – hole size equivalent to 10% of cross-sectional area of the loading arm (approximately 80 mm).

(26)

For other equipment, a maximum of five hole sizes were considered in the analysis to represent the full range of potential failure modes. This range of hole sizes was considered for storage tanks, pumps and associated internal pipelines. The hole sizes used to define the hazardous scenarios are presented in Table 5.

Table 5: Representative Hole Sizes

Hole Size Category Representative Hole Size Hole Size Range

Small 5 mm dh≤ 5 mm

Medium 20 mm 5 mm > dh≥ 20 mm

Large 50 mm 20 mm > dh≥ 50 mm

Very Large 100 mm 50 mm > dh≥ 150 mm

Rupture Full bore dh> 150 mm

For some “isolatable sections”, the hole sizes presented in Table 5 were adjusted to better represent the connections and/or piping included in that section of the process. For pipelines and pumps, the pipe diameter was used as the hole size representing the “Rupture” category. For atmospheric storage tanks and associated piping, the hole sizes representing the “Very Large” and “Rupture” categories were adjusted as necessary to reflect the larger hole sizes associated with equipment within the tank farm. The hole size representing the “Very Large” case was increased to 150 mm and the “Rupture” case was assigned the size of the largest connection to the tank.

The full list of hazardous scenarios considered in the risk assessment is provided in Appendix E. The additional hazardous scenario of tank overfill was considered for the gasoline storage tanks. This was considered to ensure the QRA examined the range of possible consequences associated with a tank farm, including the explosion of a vapour cloud formed following a release (refer to Section 7.4.2).

7.4 CONSEQUENCE EVENTS 7.4.1 Pool Fires

For the identified hazardous scenarios, the potential consequence events were mainly pool fires. A pool fire is a turbulent diffusion flame, burning above a horizontal pool of vaporising flammable liquid, with little or no momentum. The flame can emit fatal levels of radiant heat to the surrounding area. Pool fires will result following the ignition of a continuous or instantaneous release of flammable hydrocarbon liquids stored at atmospheric conditions.

The size of a pool fire is determined by operating conditions, the burning rate of material and the presence of spill containment. The location of each isolatable section was reviewed to assess the presence of spill containment for consideration in the modelling. The main types of scenarios considered in the QRA are discussed below, with the associated spill containment:

Wharf Operations

 A pool fire resulting from the ignition of a release from a loading arm. Spill containment is provided that will limit the pool size [16].

Tank Farm

 A pool fire resulting from the ignition of a release from a storage tank (and/or associated equipment) into the surrounding bund. The size of a pool fire was limited to the surface area of the bund (excluding the tank area).

 A full-surface tank fire could occur following an internal explosion of a cone roof tank or the sinking of a floating roof tank. The fire size was limited to the diameter of the tank.

Pipelines

 A pool fire resulting from the ignition of a release from a pipeline. Pipelines either run inside a pipe trench or on the pipeway edge, with the ground underneath sloping towards the pipe trench. The diameter of the fire was limited to the trench width.

(27)

Pumps

 A pool fire resulting from the ignition of a release from a pump. In most cases, the pumps were located within a kerbed area, with an internal drain to the oily water sewer (OWS). The pool size was limited to the kerbed area.

7.4.2 Vapour Cloud Explosion

In December 2005 at the Buncefield Oil Storage Depot in the UK, a number of explosions and a subsequent fire occurred. These destroyed a large part of the facility, caused widespread damage to the surrounding homes and businesses, resulted in 43 injuries and disruption to the local community [17]. The fire burned for five days and emitted a large plume of smoke into the atmosphere.

The subsequent investigation determined that the incident was due to the overfilling of a fuel storage tank containing unleaded petrol. A delivery of fuel from the pipeline feeding the tank started and the safety systems in place to shut-off the supply of fuel to prevent overfilling failed to operate. Petrol cascaded down the side of the tank and began to collect in the bund. As overfilling continued, the vapour cloud formed by the mixture of petrol and air flowed over the bund wall and travelled off-site towards the nearby industrial estate. A white mist was observed in CCTV replays of the event. The exact nature of the mist is not known with certainty: it may have been a volatile fraction of the original fuel, such as butane, or ice particles formed from the chilled, humid air as a consequence of the evaporation of the escaping fuel.

The vapour cloud was believed to have ignited in the industrial estate car park and the main explosion was massive. Subsequent explosions and a huge fire also occurred. The main explosion at the Buncefield depot was unusual because it generated much greater overpressures than would usually have been expected from a vapour cloud explosion. The mechanism of the violent explosion was the subject of additional research. Phase 1 of this research [18] indicated a likely sequence of events (although could not fully explain all the damage based on the theory). It was surmised that the gas cloud was ignited by a source at the emergency fire water pump house and a slow flame propagated outwards in all directions. When it reached a line of trees and vegetation in the lane outside the site, the flame accelerated along the tree lined road. The deflagration explosion transitioned to a detonation event further along the road. The detonation travelled in all directions, leading to a high overpressure within the flammable gas cloud and high amounts of damage over the affected area. Outside the gas cloud, the detonation became a blast wave which decayed rapidly with distance, due to the shallow nature of the flammable gas cloud.

As a result of the incident and the subsequent analysis, this type of incident is now considered important to include when assessing the risk associated with bulk fuel storage facilities. Although this type of event is considered to have a very low likelihood of occurrence, the high explosion overpressures that may result could cause significant far-field damage.

A scenario of this type was included in the QRA model. The scenario considered an overfill event associated with the 16 tanks that will store varieties of unleaded petrol. To quantify the risk, a detailed analysis was completed to determine the frequency and consequence of an overfill event. The overfill event frequency was determined by considering the frequency of filling operations and the controls in place that would act to prevent the event. The consequence assessment was completed based on knowledge developed following the investigation of the Buncefield incident [8, 18].

7.5 MAJOR ACCIDENT HAZARDS

Caltex revised the list of MAHs developed for Refinery Operations to include only those relevant to future terminal operations. Where appropriate, each hazardous scenario identified within the QRA was linked to an MAH. The resulting list of MAHs is presented in Table 6.

(28)

Table 6: List of Caltex MAHs for new Terminal

Relevant Area MAH

Number MAH Description

Considered in QRA Loc. Wharf

WRF-001 Low flash point liquid hydrocarbon loading/

unloading / Large scale loss of containment Y

WRF-003 High flash point liquid hydrocarbon loading/

unloading / Large scale loss of containment Y

Loc. Sub Berth

SUB-005 High flash point hydrocarbon loading/

unloading / Large scale loss of containment Y

Loc. atmospheric tanks at tank farm & associated pumps and pipelines

OMC-001 Hydrocarbon vapour inside empty tank /

Ignition during maintenance N

OMC-002 Low flash point hydrocarbon storage &

transfer / Large scale loss of containment Y

OMC-003 High flash point hydrocarbon storage &

(29)

8

FREQUENCY ASSESSMENT

8.1 FAILURE FREQUENCY

The likelihood of a potential release of a material from an “isolatable section” was determined from the likelihood of equipment failure within that section. Any of the identified equipment items or fittings within the “isolatable section” could potentially fail and result in a release. For each “isolatable section”, the frequency assessment involves counting the number of items (e.g. flanges, valves and instrument fittings) and summing their individual failure rates, to obtain the overall failure frequency. This “parts count” process was conducted using P&IDs, which detailed the items included within each “isolatable section”.

A full parts count was completed for equipment configurations unique to particular sections within the facility. The results of these full parts counts were then applied to similar equipment configurations. For example, for a group of similar storage tanks, the full parts count completed for one storage tank was then applied to the others within the group.

For each “isolatable section”, the overall failure frequency was distributed across the selected hole sizes. This frequency distribution was then used to determine the likelihood of the corresponding hazardous scenarios.

The frequency assessment used available historical failure rate data from the following public sources:

 UK HSE - Failure Rate used for Land Use Planning Risk Assessments [19]

 International Association of Oil & Gas Producers - Storage Incident Frequencies [20]

 E & P Forum - Hydrocarbon Leak and Ignition Data Base [21].

These sources provide the failure rate data for equipment items and fittings, and the corresponding failure rate distribution for a range of hole sizes. The failure rate data used in the QRA is summarised in Appendix B.

The failure rate data obtained from public sources was used in the QRA without modification. No specific characteristics, such as environmental factors, were identified that would require the failure data to be modified. For example, no unusually harsh conditions are experienced at the Kurnell site that would cause failure modes, such as corrosion, to occur at significantly higher rates than those typical across industry. Additionally, in Terminal operations, Caltex will continue to use its established integrity management processes, which are largely-based on industry standards. It is expected that these established processes will serve to maintain integrity management performance at a level that is at least equal to the performance reflected within the failure rate data used in the QRA model. Caltex also has established processes for corporate audits, insurance engineering surveys and external audits. These provide assurance on the effectiveness of these integrity management processes. Therefore, it is considered reasonable to use the data summarised in Appendix B without modification.

8.2 EVENT TREE ANALYSIS

Event trees were used to estimate the frequency of a consequence event for a given release scenario. Event tree analysis provides a systematic means of determining which factors will influence the release, in addition to the probability associated with each of those factors.

The following parameters are generally considered in event tree analysis:

 Probabilities of release detection and isolation

 Time taken to detect and isolate the release

 Probability of ignition (immediate ignition and delayed ignition)

An example event tree structure incorporating release detection and isolation times is presented in Figure 6.

(30)

Figure 6: Event Tree Structure (Detection and Isolation Component)

In this analysis, a targeted approach was used to determine whether the release detection and isolation times were included in the event tree analysis for a given scenario. These factors were only considered for the hazardous scenarios with consequence events that were significantly influenced by the failure to isolate. For other hazardous scenarios and consequence events (i.e. those where isolation and detection did not significantly affect the contribution to the risk profile), event tree analysis was not conducted.

8.3 TANK OVERFILL / EXPLOSION FREQUENCY

A detailed assessment was conducted to determine the frequency of an explosion following the overfill of a storage tank containing unleaded petrol. The assessment did not consider tanks containing jet fuel or diesel because these substances do not contain the light hydrocarbon components necessary to form a large vapour cloud following an overfill event.

The frequency of an explosion following tank overfill was evaluated using a fault tree to assess the overfill frequency and an event tree to quantify the explosion event frequency. The fault tree analysis determined the frequency of a significant overfill resulting from an error during tank filling operations. The analysis considered the following factors:

 The number of filling operations;

 The probability of operator error; and

 The controls in place to prevent overfill and their effectiveness.

The investigations into the Buncefield incident developed a series of recommendations for operators of bulk fuel storage depots. These recommendations were targeted at reducing the risk of an incident of this nature. In transitioning to Terminal operations, Caltex performed a gap assessment against these recommendations. This assessment helped to identify appropriate controls for an overfill / explosion scenario involving the gasoline storage tanks. A full list of the Buncefield recommendations is reproduced in Appendix C.

Based on the assessment, Caltex have adopted improved controls for tankage. A number of listed controls are already in place with the others to be implemented during the Terminal transition.

(31)

Table 7: Tank Overfill / Explosion Controls

Type of Control Controls

Prevention controls  Primary level indication with high level alarm (radar gauge)

 Independent level indication with high-high level alarm

 Independent SIL-rated trip of tank inlet valve on high-high-high level alarm

 Tank design and maintenance program in accordance with industry good practice

 Continuous monitoring of tank inventory from a centralised control room

 Operating procedures controlling quantity of material transferred

 Classification of hazardous areas and selection of equipment and protective systems is conducted in accordance with Australian Standards HB13-2007 and AS2381

 All tanks have installed earthing and maintenance program

Detection  Flammable gas detectors and control room alarms for tank

compounds of low flash point flammable liquids

 Remote CCTV monitoring for tank compounds of low flashpoint

flammable liquids

 Tank top infra-red flame detection for low flash point flammable liquid storage tanks

 Routine operator tank farm inspections

Isolation  Remote-actuated fire-rated tank inlet / outlet valves

Spill Response  Bund capacity, design and construction equivalent compliance to

AS1940

 Primary response capability to apply foam up to, and including, full bund surface area of largest tank compound

 Tank bund drainage isolation valves operable external to bund

Event Response  Tank separation distances compliant to s5.7 of AS1940.

 Caltex personnel trained in advanced fire fighting techniques, specific Caltex equipment and incident management approach common to Fire & Rescue NSW.

 Facility Emergency Plan & Pre-incident plans.

The fault tree analysis considered those controls that would directly act to prevent the tank overfill (e.g. tank level indication with high level alarm) or limit the amount of material released (e.g. gas detector linked to an alarm). For each control, the effectiveness was determined by quantifying the reliability of individual components. Where controls relied on human intervention, the derived effectiveness accounted for the probability of operator error within the time required to respond. The event tree analysis estimated the frequency of an explosion resulting from the ignition of a significantly large vapour cloud formed following an overfill. In assessing the outcome frequency, the following factors were considered:

 Ignition probability;

 The probability of stable weather conditions (i.e. atmospheric stability category F); and

 The probability of a low wind speed that would result in the formation of a significantly large vapour cloud.

The explosion event frequency was estimated to be less than 0.01 in a million per year (<1×10-8per year). This event is not considered to be a significant contributor to the overall risk profile. In comparison, the average risk of fatality from a lightning strike is 0.1 in a million per year (1×10-7per year) [2].

(32)

9

CONSEQUENCE ANALYSIS

For each hazardous scenario, consequence modelling was conducted for a range of hole sizes. The

consequence modelling determined the area impacted by each consequence event. The

consequence modelling was conducted using the software package PHAST-RISK [5]. The models within PHAST-RISK were used to determine the consequence impact distances for the heat radiation from the pool fires.

The consequence impact distances for each effect type depends on the following conditions:

 Release conditions (temperature, pressure, hole size and duration)

 Release source (elevation, orientation)

 Chemical properties

 Atmospheric conditions (wind speed).

Independent of their likelihood, several pool fire events and the VCE events were considered to have potential to cause an off-site fatality and / or injury. These results are summarised in Table 8, grouped by MAH. Table 9 lists a number of locations along the facility boundary where the MAHs have the potential for off-site fatality. Of these locations, only those positions adjacent to storage tanks are impacted by the scenarios considered in the QRA model.

Table 8: Consequence Events with Off-site Fatality or Injury Impact

MAH Related Isolatable

Sections

Consequence

Description Offsite Impact

OMC-002, OMC-003

Storage tanks adjacent the North-Eastern, Eastern and

Western boundaries

"Very large" spill fire Injury Only

Full-surface bund fire Fatality and injury

OMC-002, OMC-003 Transfer pipelines between

wharf and terminal pipeway

Fire following a large

release from pipeline Fatality and injury

OMC-002

Storage tanks near the North-Eastern and Eastern

boundaries

VCE following a tank

overfill event Fatality and injury

Table 9: Off-site Locations Potentially Impacted by MAH Scenarios

Location Event Type MAH No.

Intersection of Silver Beach Road and Captain

Cook Drive Not impacted

Kurnell Social Club Not impacted

Cook Street Boundary

Full-surface bund

fire OMC-002

VCE following a

tank overfill event OMC-002

Reserve Road Boundary

Full-surface bund

fire OMC-002

VCE following a

tank overfill event OMC-002

National Park Boundary VCE following a

tank overfill event OMC-002

Chisholm Rd Commercial Premises Full-surface bund

fire OMC-003

Sir Joseph Banks Drive Boundary Not impacted

HCE Boundary Full-surface bund

fire OMC-003

To provide guidance on the impact experienced from different fire events, the downwind impact distance for a number of consequences are presented in Table 10. These are measured from the centre point of the storage.

(33)

Table 10: Typical Impact Distances for Fire Scenarios

Event Distance to fatality

(approx 12.5 kW/m2)

Distance to injury (approx 4.7 kW/m2) Full surface tank fire – up to 50 m

diameter

Typically not reached at ground level outside of bund

Typically not reached at ground level outside of bund Full surface tank fire – up to 78 m

diameter

Typically not reached at ground level outside of bund

Typically not reached at ground level outside of bund

Full bund fire – up to 8000 m2 62 m 130 m

Full bund fire – up to 25,500 m2 101 m 194 m

Fire from catastrophic failure of any

transfer pipeline 26 m 60 m

Fire from catastrophic failure of any

loading arm 20 m 35 m

Due to the relative height of the storage tanks and the observer, the heat flux radiation experienced from a full-surface tank fire does not exceed injury levels under average weather conditions.

(34)

10 RISK ASSESSMENT

10.1 INDIVIDUAL RISK - FATALITY

Individual risk was determined by combining the frequency and consequence data for each hazardous scenario. Individual risk contours were developed by plotting lines that connect different locations experiencing the same levels of risk. The individual risk of fatality contours are presented in Figure 7.

Figure 7: Location-Specific Individual Risk of Fatality (Off-site Assessment)

The risk results were compared to the risk criteria to determine the tolerability of the risk from the proposed operations. The particular aspects of the risk criteria applicable to this study were [2]:

 Hospitals, schools, child-care facilities and old age housing development should not be exposed to individual fatality risk levels in excess of 0.5 x 10-6per year.

Reserve Road Refinery Boundary Chisholm Road Refinery Boundary Cook Street Refinery Boundary

Figure

Updating...

References