Hazard and Risk Assessment

Appendix C Hazard and Risk Assessment C1 Preliminary Hazard Analysis C2 Kurnell Buncefield Review

Appendix 1 Preliminary Hazard Analysis

Caltex Refineries (NSW) Pty Ltd Proposed Kurnell Product Terminal Preliminary Hazard Analysis 15 May 2013 R4Risk Pty Ltd ACN 134 478 050 15 Yarra Street (PO Box 5023) South Melbourne VIC 3205 P: 03 9268 9700 F: 03 8678 0650 E: solutions@r4risk.com.au www.r4risk.com.au

Confidential and Sensitive Document Exempt from disclosure under the Government Information (Public Access) Act 2009 (NSW) The complete Preliminary Hazard Analysis Report is provided to the NSW Department of Planning & Infrastructure ( DP&I ) by Caltex Refineries (NSW) Pty Ltd ( Caltex ) in confidence for use only within DP&I. It is submitted on the basis that there is an overriding public interest against disclosure pursuant to section 14(2) of the Government Information (Public Access) Act 2009 (NSW) (the Act ). The Report is exempt from disclosure under the Act on the grounds that it contains information associated with the storage of security sensitive petroleum finished product and information that is commercial-in-confidence. The information which is exempt from disclosure applies specifically to the following parts of the Report: Appendix E Lists of Hazardous Scenarios This report must not be copied or distributed outside DP&I without the express permission of Caltex. 15 May 2013 Page 2 of 43

DOCUMENT CONTROL Project Title Proposed Kurnell Product Terminal - Preliminary Hazard Analysis Client Name Caltex Refineries (NSW) Pty Ltd Project No. 107-24 Project Manager Patrick Walker Report Author (s) Patrick Walker Release Issue Date Reviewed by Approved by Comments Release 1 27 February 2013 L. Dreher L. Dreher Issued to Client Release 2 18 April 2013 L. Dreher L. Dreher Revised with Client comments Release 3 26 April 2013 L. Dreher L. Dreher Updated Release 4 8 May 2013 L. Dreher L. Dreher Updated Release 5 15 May 2013 L. Dreher L. Dreher Updated 15 May 2013 Page 3 of 43

Table of Contents 1 EXECUTIVE SUMMARY... 6 1.1 Major Risk Contributors... 6 1.2 Individual Risk - Fatality... 7 1.3 Individual Risk - Injury... 7 1.4 Societal Risk - Off-site... 7 1.5 Risk of Property Damage and Accident Propagation... 8 1.6 Biophysical Risk... 8 1.7 Assumptions And Sensitivity... 9 1.8 Related Safety Studies... 9 1.9 Findings And Recommendations... 9 2 ACRONYMS & GLOSSARY... 10 2.1 Acronyms... 10 2.2 Glossary... 10 3 INTRODUCTION... 12 3.1 Background... 12 3.2 The Project... 12 3.2.1 Scope... 12 3.2.2 Aim... 12 3.3 The Preliminary Hazard Analysis... 12 3.3.1 Scope... 12 3.3.2 Aim... 13 4 SITE & PROJECT DESCRIPTION... 14 4.1 Project Location... 14 4.2 Project Description... 14 4.2.1 Wharf Operation... 14 4.2.2 Tank Farm Operation... 14 4.2.3 Associated Pipelines and Pumps... 14 5 METHODOLOGY... 17 5.1 Hazard Identification... 18 5.1.1 Data Collection... 18 5.1.2 Scenario Development... 19 5.2 Frequency Assessment... 19 5.2.1 Scenario Frequency... 19 5.2.2 Event Tree Analysis... 19 5.3 Consequence Assessment... 19 5.3.1 Pool Fires... 20 15 May 2013 Page 4 of 43

5.3.2 Vapour Cloud Explosions... 20 5.3.3 Vulnerability Models... 20 5.4 Risk Assessment... 20 5.5 Study Assumptions... 20 6 RISK CRITERIA... 21 6.1 Individual Risk - Fatality... 21 6.2 Individual Risk - Injury... 21 6.3 Societal Risk Criteria... 21 6.4 Risk of Property Damage and Accident Propagation... 22 6.5 Biophysical Risk... 22 7 HAZARD IDENTIFICATION... 23 7.1 Hazardous Materials... 23 7.2 Isolatable Sections... 23 7.3 Hazardous Scenarios... 23 7.4 Consequence Events... 24 7.4.1 Pool Fires... 24 7.4.2 Vapour Cloud Explosion... 25 7.5 Major Accident Hazards... 25 8 FREQUENCY ASSESSMENT... 27 8.1 Failure Frequency... 27 8.2 Event Tree Analysis... 27 8.3 Tank Overfill / Explosion Frequency... 28 9 CONSEQUENCE ANALYSIS... 30 10 RISK ASSESSMENT... 32 10.1 Individual Risk - Fatality... 32 10.2 Individual Risk - Injury... 35 10.3 Societal Risk Off-site Population... 37 10.4 Risk of Property Damage and Accident Propagation... 37 10.5 Biophysical Risk... 39 10.6 Sensitivity Analysis... 40 11 COMPARISON TO RISK AT THE EXISTING FACILITY... 41 12 REFERENCES... 42 Appendix A Appendix B Appendix C Appendix D Appendix E Appendix F Assumption Register Failure Rate Data Buncefield Recommendations Off-site Population Data Lists of Hazardous Scenarios Qualifications and Experience of the Hazard Analysis Team 15 May 2013 Page 5 of 43

1 EXECUTIVE SUMMARY Caltex is seeking development approval to convert the existing Kurnell Refinery into a Finished Product Terminal (the Project ). In accordance with the NSW Department of Planning and Infrastructure (DP&I) Director -General s Requirements (DGRs) for the Development, a Preliminary Hazard Analysis (PHA) Report was prepared by R4Risk for inclusion in the Environment Impact Statement (EIS) for SSD-5544. The PHA report was prepared with reference to the State Environment Planning Policy No 33 - Hazardous and Offensive Development [1], and in accordance with the NSW DP&I s Hazardous Industry Planning Advisory Papers No. 4 - Risk Criteria (HIPAP4) [2] and No. 6 - Hazard Analysis (HIPAP6) [3]. The Project comprises the following principal components: Continued use of parts of the existing refinery, in a manner similar to that currently in place, for the storage and distribution of petroleum products. A number of existing crude oil tanks are to be cleaned and modified to allow for the storage of refined product (i.e. conversion to finished product tanks). A small number of other tanks already storing one type of refined product are to be converted to store alternative products. New pumps, pipes and electrical infrastructure are to be installed within the Project Area (defined in Section 4.1). A range of ancillary works is also to be undertaken to improve efficiency and to facilitate the conversion of the refinery into a terminal. These ancillary works include consolidation and upgrades to the utilities, transportation and management systems at the site. The refinery plant would also be shut down, depressurised, de-inventoried and left in situ. Caltex shut down, depressurise and de-inventory the refinery plant during routine maintenance activities as part of the existing operation and therefore this action does not form part of the Project. The Project is expected to be undertaken over a 54 month period. In preparing the PHA Report, R4Risk has investigated the risk of operations associated with the following areas: Tank farm operations Wharf operations associated with fixed shore assets (i.e. excluding shipping activities); and Associated pipelines and pumps. The quantitative risk assessment (QRA) methodology was used to determine the risk profile for the Project. The methodology involved the following key steps: Hazard Identification Consequence Assessment Frequency Assessment Risk Assessment. The tolerability of the calculated risk was assessed by comparison with the risk criteria specified in HIPAP4 [2]. The following sections summarise the major findings from the risk assessment. The corresponding risk contours are presented in Section 10. 1.1 MAJOR RISK CONTRIBUTORS The PHA examined scenarios associated with the Major Accident Hazards (MAHs) that involved the loss of containment of flammable (gasoline, jet fuel, slops) or combustible (diesel) material. The study considered the material that could be released from storage tanks, pumps and loading arms, as well as the associated pipelines. The QRA determined the potential that released material would ignite, resulting in a pool fire. The study also evaluated the frequency and potential consequence of a 15 May 2013 Page 6 of 43

Buncefield-type vapour cloud explosion (VCE). Although assessed as extremely unlikely, the Buncefield-type VCE event was included in the QRA. 1.2 INDIVIDUAL RISK - FATALITY Location-specific individual risk (LSIR) contours for the risk of fatality were developed. These were used to assess the tolerability of the risk against the risk criteria described in HIPAP4. As each of the risk contours do not extend into the respective land-use areas to which the criteria are applied, the offsite fatality risk criteria are therefore satisfied. This is summarised in Table 1. Table 1: LSIR Fatality Risk Tolerance Criteria [2] Tolerance Criteria Land Use (risk in a million per year) Sensitive areas, such as hospitals and schools 0.5 Residential developments and continuous occupancy, such as hotels and resorts 1.0 Commercial developments, including retail centres, offices and entertainment centres 5 Sporting complexes and active open space 10 Industrial areas 50 1.3 INDIVIDUAL RISK - INJURY LSIR Results The relevant LSIR contours do not extend to each of these areas. All criteria are satisfied. Location-specific individual risk (LSIR) contours for the risk of injury were developed. The tolerability of the injury risk results was determined by comparison with the HIPAP4 injury risk criteria. Similar to the fatality risk contours, the injury risk contours do not extend into the respective land-use areas to which the criteria are applied. The injury risk criteria are therefore satisfied. This is summarised in Table 2. Table 2: LSIR Injury Risk Tolerance Criteria [2] Individual Injury Risk Criteria Incident heat flux radiation at residential and sensitive areas exceeding 4.7 kw/m 2. Incident explosion overpressure at residential and sensitive use areas should not exceed 7 kpa at frequencies. Toxic concentrations in residential and sensitive use areas exceed a level which would be seriously injurious to sensitive members of the community following a relatively short period of exposure. Tolerance Criteria (risk in a million per year) LSIR Results 50 The relevant LSIR contours do not extend to these areas. 50 The criteria is met. 10 Not applicable, as the QRA did not involve scenarios which could result in this type of event. 1.4 SOCIETAL RISK - OFF-SITE The societal risk F-N curve was developed. This considered potential impacts on the off-site population. The tolerability of the risk was assessed using the indicative societal risk criteria described in HIPAP4 [2]. The societal risk assessment, compared against these criteria, is presented in Figure 1. The societal risk F-N curve for the proposed operations lies fully below the negligible line. In this region, the societal risk is not considered significant, provided other individual risk criteria are met. As described in the preceding sections, the individual risk criteria for fatality and injury are satisfied. Therefore the societal risk is also considered to be tolerable. 15 May 2013 Page 7 of 43

1.00E-01 Frequency of N or more fatalities (F, /year) 1.00E-02 1.00E-03 1.00E-04 1.00E-05 1.00E-06 1.00E-07 1.00E-08 Negligible ALARP Intolerable 1.00E-09 1 10 100 1000 Number of Fatalities (N) Figure 1: Societal Risk Results Off-site Population 1.5 RISK OF PROPERTY DAMAGE AND ACCIDENT PROPAGATION Location-specific risk contours were developed to represent the risk of property damage and accident propagation. The tolerability of the results was determined by comparison with corresponding risk criteria outlined in HIPAP4. The risk contours do not extend to off-site areas. The risk criteria are therefore satisfied. This is summarised in Table 3. Table 3: Risk of Property Damage And Accident Propagation Tolerance Criteria [2] Tolerance Criteria Risk Criteria (risk in a million per LSIR Results year) Incident heat flux radiation at neighbouring potentially hazardous installations or at land zoned to accommodate such installations for the 23 kw/m 2 heat flux. 50 Incident explosion overpressure at neighbouring potentially hazardous installations, at land zoned to accommodate such installations or at nearest public buildings for the 14 kpa explosion overpressure level 1.6 BIOPHYSICAL RISK 50 The relevant LSIR contours do not extend to these areas. The criteria are met. The risk to the biophysical environment was assessed by examining the potential for identified release scenarios to impact on the long-term viability of the surrounding ecosystems. For different sections of the facility, the assessment considered the key controls that would prevent, or mitigate, the impact of a release. The analysis demonstrated controls would be in place that would either minimise the potential for a release or contain product if a release did occur. Therefore, a release of product from the terminal would not pose a threat to the long-term viability of the ecosystem. 15 May 2013 Page 8 of 43

1.7 ASSUMPTIONS AND SENSITIVITY In completing the QRA, a number of technical assumptions were made. These assumptions are described in Appendix A. For key assumptions, details of the applied methodology and corresponding references are also included. To support the risk assessment conclusions, a review was conducted to determine the sensitivity of the QRA results to key parameters. The review examined the parameters such as failure frequency and the radiant heat vulnerability model. This review showed that the risk tolerability remained unchanged, despite the modifications made. Details of the sensitivity analysis are provided in Section 10.6. 1.8 RELATED SAFETY STUDIES In conducting the PHA, R4Risk reviewed, or were provide access to, a number of detailed studies conducted for the Kurnell site. These included the following studies: Process Hazard Analysis for the Terminal Conversion and the Caltex Port and Marine Works Project Major Hazard Facility Safety Report for the Kurnell Refinery Kurnell Peninsula Land Use Safety Study 2007 Various historical fire safety studies examining the refinery operations and the proposed terminal Caltex review of Buncefield Report Recommendations. 1.9 FINDINGS AND RECOMMENDATIONS This quantitative risk assessment demonstrates that the risk levels calculated for the Project satisfy the risk criteria specified in HIPAP4. Compared with existing refinery operations, the off-site risk profile is considerably reduced. This outcome is expected, because the Project involves a downscaling of the existing operations, i.e. a reduction in the scale and complexity of the operations at the site. The studies listed in Section 1.8 provided input into the development of the design for the proposed terminal. Caltex has identified risk reduction recommendations using its Riskman2 methodology. These are documented in the detailed process hazard analysis records and are tracked to completion by Caltex s project management process. No recommendations were made as a result of this QRA. 15 May 2013 Page 9 of 43

2 ACRONYMS & GLOSSARY 2.1 ACRONYMS ALARP BLEVE Caltex CCTV DCS DGRs DP&I EIS ESDV HES HIPAP4 HIPAP6 HSE IR IRPA Loc. LPG LSIR MAH MOV MSDS OWS P&ID PFD PHA PULP QRA SSD SPULP VCE ULP As low as reasonably practicable Boiling-liquid expanding-vapour explosion Caltex Refineries (NSW) Pty Ltd Closed-circuit television Distributed control system Director-General s Requirements Department of Planning and Infrastructure Environment impact statement Emergency shutdown valve Health, environment, safety New South Wales Department of Planning Hazardous Industry Planning Advisory Paper No. 4 [2] New South Wales Department of Planning Hazardous Industry Planning Advisory Paper No. 6 [3] Health & Safety Executive (United Kingdom) Individual risk Individual risk per annum Loss of containment Liquefied petroleum gas Location-specific individual risk Major Accident Hazard Motor-operated valve Material safety data sheet Oily Water Sewer Piping and instrumentation diagram Probability of failure on demand Preliminary hazard analysis Premium unleaded petrol Quantitative risk assessment Significant State Development Super-premium unleaded petrol Vapour cloud explosion Unleaded petrol 2.2 GLOSSARY Consequence Consequence Event Eastern Tank Area Event Frequency Frequency Hazard Hazardous Scenario The severity associated with an event in this instance the heat radiation from the pool fire events, i.e. the potential effects of a hazardous event. The end event associated with a failure and release, considering all detection, isolation and ignition factors, e.g. pool fire, flash fire etc. The Eastern Tank Area contains existing finished product tanks, some of which would need minor conversion works as part of the Project. It also contains the Oil Movements Centre (OMC). The frequency assigned to a specific consequence event The number of occurrences of an event expressed per unit time. It is usually expressed as the likelihood of an event occurring per annum. A physical situation with the potential for human injury, damage to property, damage to the environment or some combination of these. The accidental release of a hazardous material from equipment or piping, from identified isolatable section of terminal operation. 15 May 2013 Page 10 of 43

Individual Risk (IR) Individual Risk Contours Individual Risk of Fatality Isolatable Section Probability Quantitative Risk Assessment Risk RiskMan2 Western Tank Area The frequency at which an individual may be expected to sustain a given level of harm from the realisation of specified hazards. As individual risk (IR) is calculated at a point, calculating the IR at many points allows the plotting of IR contours, these being lines that indicate constant levels of risk. Most commonly used are the 1 chance per millionyear contour and the 10 chances per million-year contour. Individual risk, with harm measured in terms of fatality. It is calculated at a particular point for a stationary, unprotected person for 24 hours per day, 365 days per year. Commonly expressed in chances of fatality per million years. A system of pipes or vessels containing the hazardous materials that are bounded by specific isolation points, which can be operated to isolate the inventory in the event of an emergency. The expression for the likelihood of an occurrence of an event or an event sequence or the likelihood of the success or failure of an event on test or demand. By definition, probability must be expressed as a number between 0 and 1. A risk assessment undertaken by combining quantitative evaluations of event frequency and consequence. The combination of frequency and consequences, the chance of an event happening that can cause specific consequences. Caltex s standard process for health, environment, safety (HES) and asset related risk management. RiskMan2 provides a standardised and systematic approach to the identification of hazards, assessment of risk and effective adoption and maintenance of control measures for HES and certain asset risks. The Western Tank Area is primarily made up of the existing Crude Oil Tanks and the Waste Water Treatment Plant. All the Crude Oil Tanks would require conversion as part of the Project. It is proposed that the area would also include the new product pumps area and the new slops pumps area. 15 May 2013 Page 11 of 43

3 INTRODUCTION 3.1 BACKGROUND Caltex is seeking development approval to convert the existing Kurnell Refinery into a Finished Product Terminal (the Project ). In accordance with the NSW DP&I DGRs for the Development, a PHA report was prepared by R4Risk for inclusion in the EIS for SSD-5544. The PHA report was prepared with reference to the State Environment Planning Policy No 33 - Hazardous and Offensive Development [1], and in accordance with the NSW DP&I s Hazardous Industry Planning Advisory Papers No. 4 - Risk Criteria [2] and No. 6 - Hazard Analysis [3]. The experience and qualifications of the project team are included in Appendix E. This report details the methodology and presents the off-site risk profile for the proposed operations. The tolerability of the results has been assessed by comparison with the risk criteria specified in HIPAP4 [2]. 3.2 THE PROJECT 3.2.1 Scope The Project comprises the following principal components: Continued use of parts of the existing refinery, in a manner similar to that currently in place, for the storage and distribution of petroleum products. A number of existing crude oil tanks are to be cleaned and modified to allow for the storage of refined product (i.e. conversion to finished product tanks). A small number of other tanks already storing one type of refined product are to be converted to store alternative products. New pumps, pipes and electrical infrastructure are to be installed within the Project Area (defined in Section 4.1). A range of ancillary works are also to be undertaken to improve efficiency and to facilitate the conversion of the refinery into a terminal. These ancillary works include consolidation and upgrades to the utilities, transportation and management systems at the site. The refinery plant would also be shut down, depressurised, de-inventoried and left in situ. Caltex shut down, depressurise and de-inventory the refinery plant during routine maintenance activities as part of the existing operation and therefore this action does not form part of the Project. The Project is expected to be undertaken over a 54 month period. 3.2.2 Aim The aim of the Project is to allow the site to be utilised as a terminal where finished products would be received by ship, stored in tanks and leave the site, predominantly by pipeline, to the Caltex Banksmeadow Terminal, Silverwater Terminal, Joint User Facility at Sydney Airport, or to the Caltex Newcastle Terminal via the Newcastle Pipeline. The current capability for outloading via the wharf is to be retained, but would be used infrequently. Under typical operations, road transport of products from the site would cease. However, in exceptional circumstances, some road transport of product may be required. 3.3 THE PRELIMINARY HAZARD ANALYSIS 3.3.1 Scope This PHA has identified and assessed hazards and risks associated with the following operational areas of the proposed development: Tank farm operations; Wharf operations associated with fixed shore assets (i.e. excluding shipping activities); and Associated pipelines and pumps. 15 May 2013 Page 12 of 43

3.3.2 Aim The aim of the PHA is to: Provide an assessment of the hazards and risks associated with the proposed works; and Evaluate the calculated risk levels against the land-use planning criteria for off-site risk (as specified in HIPAP4). This aim is in accordance with the requirements of the NSW DP&I DGRs for the Project and is fully consistent with Caltex s internal standards for the management of hazards and risks at its facilities. The risk associated with the Project has been assessed quantitatively using the generally-accepted QRA methodology. To assess the off-site risk exposure, the following outputs were generated from the QRA model: Individual risk of fatality contours; Individual risk of injury contours; Societal risk F-N curve ; and Risk of property damage and accident propagation. In addition to this PHA report, Caltex has also undertaken a number of detailed internal Process Hazard Analysis studies on the proposed design. These studies represent Caltex s collective knowledge of the nature and type of hazards associated with both existing and proposed operations. They are therefore considered an appropriate basis for the hazard identification step of this PHA. 15 May 2013 Page 13 of 43

4 SITE & PROJECT DESCRIPTION 4.1 PROJECT LOCATION The Project Area is located at the site of the existing refinery, which is on the Kurnell Peninsula within Sutherland Shire Local Government Area, approximately 15 km south of Sydney s CBD. The site and Project Area are illustrated in Figure 2. A site plan showing the existing operations is presented in Figure 3. The figure also highlights the different land-uses that surround the site. There are a number of light-industrial sites located near the western boundary. To the north, there is a mixture of commercial properties and residential areas. The nearest residential areas are adjacent to the north-eastern corner of the site. 4.2 PROJECT DESCRIPTION The Kurnell Refinery is to be converted from an operating refinery to a bulk liquid fuel terminal, storing flammable and combustible liquids. The operations at Kurnell will be limited to wharf operations, tank farm storage and associated pipelines and pumps for transfers of the fuels. The following sections summarise the proposed operations at the facility. 4.2.1 Wharf Operation Gasoline, jet fuel and fuel oil will be received by ship at the fixed berths of Kurnell Wharf. These fuels will be then transferred to the terminal via two loading arms and associated pipelines. Receipt of diesel will involve similar operations, however, it may also be received at the submarine berth. Slop produced during terminal operations will be transferred to the wharf for loading onto ships. A separate Development Application, EIS and Preliminary Hazard Analysis Report have been produced addressing the hazards and risks associated with dredging, demolition and construction activities, as well as those associated with operational activities due to the mooring of larger ships at Kurnell Wharf (refer SSD-5353). 4.2.2 Tank Farm Operation The flammable and combustible liquids received from the wharf are to be stored in the atmospheric storage tanks of the tank farm. The Project will involve the continued use of parts of the existing refinery plot, in a manner similar to that currently in place, for the storage and distribution of petroleum products. A number of existing crude oil tanks would be cleaned and modified to allow for the storage of refined product (i.e. conversion to finished product tanks). A small number of other tanks already storing one type of refined product would be converted to store another refined product. 4.2.3 Associated Pipelines and Pumps The flammable and combustible liquids unloaded at the wharf will be transferred via pipeline to storage tanks within the tank farm. When required, these products will then be pumped via pipelines from the storage tanks to the Banksmeadow Terminal for further distribution. These existing pipelines run from the tank farm, out along the wharf before travelling beneath Botany Bay to Banksmeadow. Lastly, slop will be pumped out to a fixed berth at the wharf, via a combination of new and existing lines (referred to as Slop Lines ). 15 May 2013 Page 14 of 43

Site Project Area Figure 2: Location of Site and Project Area 15 May 2013 Page 15 of 43

Figure 3: Site Plan [4] 15 May 2013 Page 16 of 43

5 METHODOLOGY The methodology for conducting a PHA is well established in Australia. This assessment was carried out as per the guidelines provided within HIPAP4 and HIPAP6. Consistent with the potential for a high consequence event to occur at site, and the anticipated classification of the proposed terminal as a Major Hazard Facility, the QRA methodology was used for the purpose of off-site risk determination. The tolerability of the risk was assessed using the risk criteria specified in HIPAP4. This section presents a summary of the QRA methodology applied to this project. The key steps in a QRA are as follows: Hazard Identification Consequence Assessment Frequency Assessment Risk Assessment. The approach applied in this study follows these basic steps. A flow chart illustrating this approach is shown in Figure 4. Additional details on each of the steps are provided in the following sections. 15 May 2013 Page 17 of 43

Process Information P&IDs Flow Diagrams Emergency detection and shutdown systems Hazard Identification Workshops Chemical data Met data Plant and equipment layout Emerg. response Major Accident Identification Hazardous materials Failure modes Loss scenarios Failure data System data Detection and isolation strategies Ignition probabilities Consequence Assessment Fire / Explosions Flammable vapour dispersion Toxic vapour dispersion Impact Determination Frequency Assessment Fault Tree analysis Event Tree analysis End Event Frequency Determination Risk Calculations Individual risk Societal risk Population data Identify major risk contributors Propose risk reduction measures Not Acceptable Risk Evaluation Determine risk acceptability Acceptable Risk criteria STOP Figure 4: Overview of QRA Methodology 5.1 HAZARD IDENTIFICATION 5.1.1 Data Collection Data on the hazards at the site and details needed to complete the risk assessment were drawn from technical information on the proposed Terminal operations. This information included the following, as applicable: Engineering drawings (e.g. process flow diagram s, piping and instrumentation diagrams (P&IDs) etc.) 15 May 2013 Page 18 of 43

Site layout plans Area plans Major inventories of combustible, flammable and toxic substances stored / handled Release detection and isolation strategies and systems Release containment systems Description of surrounding land use and estimates of population densities. 5.1.2 Scenario Development The proposed activities for the facility when in terminal operation mode were defined to identify potential hazardous scenarios. This process involved the completion of a Process Hazard Analysis study by a suitably-qualified team of Caltex personnel. The study did not identify any major accident hazards (MAHs) that were additional to those previously identified for refinery operations covering the tank farm, wharf and sub-berth operations. Conversion to terminal operations will result in a number of the previously-defined MAHs being eliminated. Terminal operations will not include liquefied gases (e.g. propane, butane) or high-temperature / high-pressure processes, such as those present within existing refinery operations. The use of liquid chlorine for biocide treatment of salt water cooling water will also be discontinued. The identified MAH scenarios involve the release / spill of flammable or combustible liquids resulting in a fire when ignited. This could occur at various locations including storage tanks, pumps and loading arms. These hazardous scenarios were analysed in the QRA, based on the associated material properties and transfer operations. The QRA also evaluated the frequency and consequence of a Buncefield-type vapour cloud explosion. To determine the amount of material that could potentially be involved in a release, factors such as inventory, leak detection, and leak isolation strategies were considered. Event tree models were developed for each potential release scenario. As the most likely MAH scenarios involved the release of flammable material, the main events considered in the analysis were pool fires resulting from an ignited release. 5.2 FREQUENCY ASSESSMENT The frequency assessment involved defining the potential release sources and then determining the likelihood (frequency) of the various releases. The assessment is a two-stage process that involves evaluating the release frequency and then estimating the likelihood of the possible outcomes of the release using an event tree. 5.2.1 Scenario Frequency The available engineering drawings for the facility were reviewed to develop a parts count of failure items for each of the hazardous scenarios. Failure rates based on historical industry failure frequency data were utilised to estimate the likelihood of the various hazardous scenarios. The failure rate data for storage tanks, piping, valves, and other relevant equipment items was sourced from published references and other appropriate sources. The failure rate data used in the study is presented in Appendix B. 5.2.2 Event Tree Analysis Where appropriate, event trees were developed to estimate the frequency of the potential consequence events that may result from a given release scenario. This analysis incorporated the effectiveness of proposed detection and isolation systems when assessing consequence events that are most influenced by time. 5.3 CONSEQUENCE ASSESSMENT Following the frequency assessment, the consequence events were identified. The potential impacts of these events were assessed using the consequence models available within PHAST-RISK [5]. These models consider the nature of the release, including the release rate, discharge velocity and duration. The models used to assess the impacts of the consequence events are outlined below. 15 May 2013 Page 19 of 43

5.3.1 Pool Fires Pool fire impacts for bund fires, tank top fires and fires in the vicinity of pumps & pipelines were determined using a solid flame model. The model represents the flame as a skewed cylinder that radiates heat outwards. The dimensions of the skewed cylinder (flame length and flame tilt) are defined using the empirical correlations within PHAST-RISK. 5.3.2 Vapour Cloud Explosions A vapour cloud explosion (VCE) occurs following the ignition of a flammable vapour cloud, coupled with acceleration of the flame front within the cloud. Within process areas, VCEs are typically associated with the confinement provided by surrounding equipment that promotes mixing and, subsequently, causes the flame front to accelerate. The current analysis considered the potential for an explosion to result from a gasoline storage tank overfill event. This type of event occurred at Buncefield (United Kingdom) in 2005. Investigations into that incident concluded that the observed high levels of overpressure, and their rate of decay, are difficult to reproduce with the standard explosion models [6] (e.g. the Multi-Energy Method [7]). Therefore, the overpressure from these events was determined using information that was specifically developed to assess explosions associated with tank overfills [8]. 5.3.3 Vulnerability Models In order to evaluate the risk profile, the effects of the pool fire and VCE events must be estimated in terms of the potential to cause fatality or injury. Vulnerability models were used to correlate the impact (e.g. heat radiation) of an event to the potential for fatality or injury. The vulnerability models used in the study are described in Appendix A. 5.4 RISK ASSESSMENT Both individual and societal risk results were generated to define the risk profile for terminal operations. These results were produced by combining the frequency and consequence estimates for each of the hazardous scenarios. The following risk measures were generated: Location-specific individual risk (LSIR) contours for fatality and injury risk A graphical representation of individual risk that uses the risk values at each point to construct iso-risk contours. The contours are presented on a map showing the risk relative to the proposed terminal and surrounding land-uses. Societal risk F-N curve for off-site population This is a societal risk measure that communicates the potential for hazardous scenarios to cause multiple fatalities by plotting the frequency of N or more fatalities (F) against the number of fatalities (N). This is presented as a graph. Calculation of the societal risk measures requires knowledge of the population distribution surrounding the site. The following information is required for each location where people may be present (refer to Appendix D): Geographical location; Number of people present at different times of the day; Percentage of people located indoors; and Building type (if applicable). From the individual risk results, a list of risk contributors at specific locations was determined. This allowed the major contributors to the risk to be identified, as well as the most influential hazardous scenarios. From this information, targeted risk reduction actions can be readily identified that will deliver the most effective risk reduction outcome (i.e. the greatest reduction in risk). 5.5 STUDY ASSUMPTIONS In conducting the QRA, a number of technical assumptions were made. assumptions are described in Appendix A. The key technical 15 May 2013 Page 20 of 43

6 RISK CRITERIA The tolerability of the calculated risk is assessed by comparison with an appropriate risk target or criterion. The risk criteria used to make this assessment are specified in HIPAP4 [2]. The risk criteria are detailed below. 6.1 INDIVIDUAL RISK - FATALITY The individual risk of fatality criteria described in HIPAP4 that are applicable to proposed hazardous developments are as follows: Hospitals, schools, child-care facilities and old age housing development should not be exposed to individual fatality risk levels in excess of half in one million per year (0.5 x 10-6 per year). Residential developments and places of continuous occupancy, such as hotels and tourist resorts, should not be exposed to individual fatality risk levels in excess of one in a million per year (1 x 10-6 per year). Commercial developments, including offices, retail centres, warehouses with showrooms, restaurants and entertainment centres, should not be exposed to individual fatality risk levels in excess of five in a million per year (5 x 10-6 per year). Sporting complexes and active open space areas should not be exposed to individual fatality risk levels in excess of ten in a million per year (10 x 10-6 per year). Individual fatality risk levels for industrial sites at levels of 50 in a million per year (50 x 10-6 per year) should, as a target, be contained within the boundaries of the site where applicable. These criteria were developed based on a principle that if the risk from a potentially hazardous installation is less than most risks being experienced by the community (e.g. voluntary risks, transportation risks), then that risk may be tolerated. This principle is consistent with the basis of risk criteria adopted by most authorities internationally. The criterion for residential areas is demonstrably very low in relation to the background risk. It is considered conservative, as it assumed an individual is present and exposed for 24 hours per day, 365 days per year. 6.2 INDIVIDUAL RISK - INJURY HIPAP4 also outlines risk criteria for effects that may cause injury to people but will not necessarily cause fatality. The injury risk criteria are separated based on the different effect types, i.e., heat radiation, explosion overpressure and toxic exposure. HIPAP4 sets the following injury risk criteria: Heat flux radiation at residential and sensitive use areas should not exceed 4.7 kw/m 2 at a frequency of more than 50 x 10-6 per year. Explosion overpressure at residential and sensitive use areas should not exceed 7 kpa at frequencies of more than 50 x 10-6 per year. Toxic concentrations at residential and sensitive use areas should not exceed a level which would be seriously injurious to sensitive members of the community following a relatively short period of exposure at a maximum frequency of 10 x 10-6 per year. 6.3 SOCIETAL RISK CRITERIA The NSW DP&I has adopted indicative criteria to assess the off-site societal risk. The criteria take into account the fact that society is particularly intolerant of accidents, which although infrequent, have the potential to cause multiple fatalities. The criteria are presented on the F-N graph in Figure 5. The criteria define three risk regions as follows [2]: Intolerable: above the intolerable line, the activity is considered undesirable, even if individual risk criteria are met. ALARP ( as low as reasonable practicable ): within the ALARP region, the emphasis should be on reducing risk as far as possible towards the negligible line (i.e. ensuring that risks have been reduced to as low as reasonably practicable). Provided other quantitative and qualitative criteria of HIPAP 4 are met, the risks from the activity may be considered tolerable within the 15 May 2013 Page 21 of 43

ALARP region as long as all reasonably practical risk reduction measures have been implemented. Negligible: below the negligible line the societal risk is not considered significant, provided other individual risk criteria are met. 1.00E-01 Frequency of N or more fatalities (F, /year) 1.00E-02 1.00E-03 1.00E-04 1.00E-05 1.00E-06 1.00E-07 1.00E-08 Negligible ALARP Intolerable 1.00E-09 1 10 100 1000 Figure 5: Indicative Societal Risk Criteria [2] 6.4 RISK OF PROPERTY DAMAGE AND ACCIDENT PROPAGATION HIPAP4 sets risk criteria that reflect the potential for property damage and accident propagation. Assessment against the criteria provides an indication of the risk that an accident at the facility may cause damage to buildings and / or propagate to involve neighbouring industrial operations, causing further hazardous incidents, i.e. the so-called 'domino effect'. HIPAP4 sets the following criteria for risk of damage to property and accident propagation: Heat flux radiation at neighbouring potentially hazardous installations, or at land zoned to accommodate such installations, should not exceed a risk of 50 x 10-6 per year for the 23 kw/m 2 heat flux level. Explosion overpressure at neighbouring potentially hazardous installations, at land zoned to accommodate such installations or at nearest public buildings should not exceed a risk of 50 x 10-6 per year for the 14 kpa explosion overpressure level. 6.5 BIOPHYSICAL RISK Number of Fatalities (N) HIPAP4 outlines risk criteria addressing the risk from accidental releases to biophysical environment. The criteria focuses on the potential acute and chronic toxic impacts that an accidental release may have on whole systems and populations, rather than individual plants or animals. HIPAP4 expresses the criteria as follows: Industrial developments should not be sited in proximity to sensitive natural environmental areas where the effects (consequences) of the more likely accidental emissions may threaten the long-term viability of the ecosystem or any species within it. Industrial developments should not be sited in proximity to sensitive natural environmental areas where the likelihood (probability) of impacts that may threaten the long-term viability of the ecosystem or any species within it is not substantially lower than the background level of threat to the ecosystem. 15 May 2013 Page 22 of 43

7 HAZARD IDENTIFICATION The hazard identification phase involved a review of the planned terminal operations, engineering diagrams and other relevant information. This material was used to identify all sections of the facility that would contain hazardous material during future operations. 7.1 HAZARDOUS MATERIALS The nature of the hazardous materials identified in the study was reviewed from information contained in the Material Safety Data Sheets (MSDSs) supplied by Caltex. The materials that are to be stored on-site are: Gasoline (ULP / PULP / SPULP) Jet fuel Diesel Fuel oil Slop. Slop was assumed to be a mixture of diesel and gasoline. For the purpose of this analysis, slop was assumed to have the properties of gasoline. A list of hazardous materials identified and their respective properties is presented in Table 4. Table 4: Materials Properties [9, 10, 11, 12, 13, 14, 15] Dangerous Material HAZCHEM Goods UN No. Name Code Class Flash Point ( C) Auto-Ignition Temperature ( C) Flammability limits (in air) Gasoline 3 1203 3YE -40 370 1.4-7.4% Jet Fuel 3 1863 3Y 40 >210 0.7-6.0% Diesel C1 - - >61.5 >250 1.3-6.0% Fuel Oil C1 - - >61.5-1.0-5.0% 7.2 ISOLATABLE SECTIONS Within the QRA model, the hazardous scenarios developed following a release are dependent on the conditions in the corresponding isolatable section. These conditions were used in the consequence modelling for each hazardous scenario and include: Material Process conditions (e.g. temperature and pressure ) State (i.e. vapour or liquid) Inventory Flow rate Utilisation (i.e. percentage of the time in use). 7.3 HAZARDOUS SCENARIOS Hazardous scenarios were developed to represent the range of possible failures associated with each isolatable section. These failure modes were represented as releases from selected hole sizes. For the wharf operations, the following two failure cases associated with the loading / unloading arms were considered: Full bore release hole size equivalent to diameter of the loading arm (approx imately 250 mm) Medium release hole size equivalent to 10% of cross-sectional area of the loading arm (approximately 80 mm). 15 May 2013 Page 23 of 43

For other equipment, a maximum of five hole sizes were considered in the analysis to represent the full range of potential failure modes. This range of hole sizes was considered for storage tanks, pumps and associated internal pipelines. The hole sizes used to define the hazardous scenarios are presented in Table 5. Table 5: Representative Hole Sizes Hole Size Category Representative Hole Size Hole Size Range Small 5 mm d h 5 mm Medium 20 mm 5 mm > d h 20 mm Large 50 mm 20 mm > d h 50 mm Very Large 100 mm 50 mm > d h 150 mm Rupture Full bore d h > 150 mm For some isolatable sections, the hole sizes presented in Table 5 were adjusted to better represent the connections and/or piping included in that section of the process. For pipelines and pumps, the pipe diameter was used as the hole size representing the Rupture category. For atmospheric storage tanks and associated piping, the hole sizes representing the Very Large and Rupture categories were adjusted as necessary to reflect the larger hole sizes associated with equipment within the tank farm. The hole size representing the Very Large case was increased to 150 mm and the Rupture case was assigned the size of the largest connection to the tank. The full list of hazardous scenarios considered in the risk assessment is provided in Appendix E. The additional hazardous scenario of tank overfill was considered for the gasoline storage tanks. This was considered to ensure the QRA examined the range of possible consequences associated with a tank farm, including the explosion of a vapour cloud formed following a release (refer to Section 7.4.2). 7.4 CONSEQUENCE EVENTS 7.4.1 Pool Fires For the identified hazardous scenarios, the potential consequence events were mainly pool fires. A pool fire is a turbulent diffusion flame, burning above a horizontal pool of vaporising flammable liquid, with little or no momentum. The flame can emit fatal levels of radiant heat to the surrounding area. Pool fires will result following the ignition of a continuous or instantaneous release of flammable hydrocarbon liquids stored at atmospheric conditions. The size of a pool fire is determined by operating conditions, the burning rate of material and the presence of spill containment. The location of each isolatable section was reviewed to assess the presence of spill containment for consideration in the modelling. The main types of scenarios considered in the QRA are discussed below, with the associated spill containment: Wharf Operations A pool fire resulting from the ignition of a release from a loading arm. Spill containment is provided that will limit the pool size [16]. Tank Farm A pool fire resulting from the ignition of a release from a storage tank (and /or associated equipment) into the surrounding bund. The size of a pool fire was limited to the surface area of the bund (excluding the tank area). A full-surface tank fire could occur following an internal explosion of a cone roof tank or the sinking of a floating roof tank. The fire size was limited to the diameter of the tank. Pipelines A pool fire resulting from the ignition of a release from a pipeline. Pipelines either run inside a pipe trench or on the pipeway edge, with the ground underneath sloping towards the pipe trench. The diameter of the fire was limited to the trench width. 15 May 2013 Page 24 of 43

Pumps A pool fire resulting from the ignition of a release from a pump. In most cases, the pumps were located within a kerbed area, with an internal drain to the oily water sewer (OWS). The pool size was limited to the kerbed area. 7.4.2 Vapour Cloud Explosion In December 2005 at the Buncefield Oil Storage Depot in the UK, a number of explosions and a subsequent fire occurred. These destroyed a large part of the facility, caused widespread damage to the surrounding homes and businesses, resulted in 43 injuries and disruption to the local community [17]. The fire burned for five days and emitted a large plume of smoke into the atmosphere. The subsequent investigation determined that the incident was due to the overfilling of a fuel storage tank containing unleaded petrol. A delivery of fuel from the pipeline feeding the tank started and the safety systems in place to shut-off the supply of fuel to prevent overfilling failed to operate. Petrol cascaded down the side of the tank and began to collect in the bund. As overfilling continued, the vapour cloud formed by the mixture of petrol and air flowed over the bund wall and travelled off-site towards the nearby industrial estate. A white mist was observed in CCTV replays of the event. The exact nature of the mist is not known with certainty: it may have been a volatile fraction of the original fuel, such as butane, or ice particles formed from the chilled, humid air as a consequence of the evaporation of the escaping fuel. The vapour cloud was believed to have ignited in the industrial estate car park and the main explosion was massive. Subsequent explosions and a huge fire also occurred. The main explosion at the Buncefield depot was unusual because it generated much greater overpressures than would usually have been expected from a vapour cloud explosion. The mechanism of the violent explosion was the subject of additional research. Phase 1 of this research [18] indicated a likely sequence of events (although could not fully explain all the damage based on the theory). It was surmised that the gas cloud was ignited by a source at the emergency fire water pump house and a slow flame propagated outwards in all directions. When it reached a line of trees and vegetation in the lane outside the site, the flame accelerated along the tree lined road. The deflagration explosion transitioned to a detonation event further along the road. The detonation travelled in all directions, leading to a high overpressure within the flammable gas cloud and high amounts of damage over the affected area. Outside the gas cloud, the detonation became a blast wave which decayed rapidly with distance, due to the shallow nature of the flammable gas cloud. As a result of the incident and the subsequent analysis, this type of incident is now considered important to include when assessing the risk associated with bulk fuel storage facilities. Although this type of event is considered to have a very low likelihood of occurrence, the high explosion overpressures that may result could cause significant far-field damage. A scenario of this type was included in the QRA model. The scenario considered an overfill event associated with the 16 tanks that will store varieties of unleaded petrol. To quantify the risk, a detailed analysis was completed to determine the frequency and consequence of an overfill event. The overfill event frequency was determined by considering the frequency of filling operations and the controls in place that would act to prevent the event. The consequence assessment was completed based on knowledge developed following the investigation of the Buncefield incident [8, 18]. 7.5 MAJOR ACCIDENT HAZARDS Caltex revised the list of MAHs developed for Refinery Operations to include only those relevant to future terminal operations. Where appropriate, each hazardous scenario identified within the QRA was linked to an MAH. The resulting list of MAHs is presented in Table 6. 15 May 2013 Page 25 of 43

Table 6: List of Caltex MAHs for new Terminal MAH Relevant Area MAH Description Number Loc. Wharf Low flash point liquid hydrocarbon loading/ WRF-001 unloading / Large scale loss of containment High flash point liquid hydrocarbon loading/ WRF-003 unloading / Large scale loss of containment Loc. Sub Berth High flash point hydrocarbon loading/ SUB-005 unloading / Large scale loss of containment Loc. atmospheric tanks at Hydrocarbon vapour inside empty tank / OMC-001 tank farm & associated Ignition during maintenance pumps and pipelines Low flash point hydrocarbon storage & OMC-002 transfer / Large scale loss of containment High flash point hydrocarbon storage & OMC-003 transfer / Large scale loss of containment Considered in QRA Y Y Y N Y Y 15 May 2013 Page 26 of 43

8 FREQUENCY ASSESSMENT 8.1 FAILURE FREQUENCY The likelihood of a potential release of a material from an isolatable section was determined from the likelihood of equipment failure within that section. Any of the identified equipment items or fittings within the isolatable section could potentially fail and result in a release. For each isolatable section, the frequency assessment involves counting the number of items (e.g. flanges, valves and instrument fittings) and summing their individual failure rates, to obtain the overall failure frequency. This parts count process was conducted using P&IDs, which detailed the items included within each isolatable section. A full parts count was completed for equipment configurations unique to particular sections within the facility. The results of these full parts counts were then applied to similar equipment configurations. For example, for a group of similar storage tanks, the full parts count completed for one storage tank was then applied to the others within the group. For each isolatable section, the overall failure frequency was distributed across the selected hole sizes. This frequency distribution was then used to determine the likelihood of the corresponding hazardous scenarios. The frequency assessment used available historical failure rate data from the following public sources: UK HSE - Failure Rate used for Land Use Planning Risk Assessments [19] International Association of Oil & Gas Producers - Storage Incident Frequencies [20] E & P Forum - Hydrocarbon Leak and Ignition Data Base [21]. These sources provide the failure rate data for equipment items and fittings, and the corresponding failure rate distribution for a range of hole sizes. The failure rate data used in the QRA is summarised in Appendix B. The failure rate data obtained from public sources was used in the QRA without modification. No specific characteristics, such as environmental factors, were identified that would require the failure data to be modified. For example, no unusually harsh conditions are experienced at the Kurnell site that would cause failure modes, such as corrosion, to occur at significantly higher rates than those typical across industry. Additionally, in Terminal operations, Caltex will continue to use its established integrity management processes, which are largely-based on industry standards. It is expected that these established processes will serve to maintain integrity management performance at a level that is at least equal to the performance reflected within the failure rate data used in the QRA model. Caltex also has established processes for corporate audits, insurance engineering surveys and external audits. These provide assurance on the effectiveness of these integrity management processes. Therefore, it is considered reasonable to use the data summarised in Appendix B without modification. 8.2 EVENT TREE ANALYSIS Event trees were used to estimate the frequency of a consequence event for a given release scenario. Event tree analysis provides a systematic means of determining which factors will influence the release, in addition to the probability associated with each of those factors. The following parameters are generally considered in event tree analysis: Probabilities of release detection and isolation Time taken to detect and isolate the release Probability of ignition (immediate ignition and delayed ignition) An example event tree structure incorporating release detection and isolation times is presented in Figure 6. 15 May 2013 Page 27 of 43

Figure 6: Event Tree Structure (Detection and Isolation Component) In this analysis, a targeted approach was used to determine whether the release detection and isolation times were included in the event tree analysis for a given scenario. These factors were only considered for the hazardous scenarios with consequence events that were significantly influenced by the failure to isolate. For other hazardous scenarios and consequence events (i.e. those where isolation and detection did not significantly affect the contribution to the risk profile), event tree analysis was not conducted. 8.3 TANK OVERFILL / EXPLOSION FREQUENCY A detailed assessment was conducted to determine the frequency of an explosion following the overfill of a storage tank containing unleaded petrol. The assessment did not consider tanks containing jet fuel or diesel because these substances do not contain the light hydrocarbon components necessary to form a large vapour cloud following an overfill event. The frequency of an explosion following tank overfill was evaluated using a fault tree to assess the overfill frequency and an event tree to quantify the explosion event frequency. The fault tree analysis determined the frequency of a significant overfill resulting from an error during tank filling operations. The analysis considered the following factors: The number of filling operations; The probability of operator error; and The controls in place to prevent overfill and their effectiveness. The investigations into the Buncefield incident developed a series of recommendations for operators of bulk fuel storage depots. These recommendations were targeted at reducing the risk of an incident of this nature. In transitioning to Terminal operations, Caltex performed a gap assessment against these recommendations. This assessment helped to identify appropriate controls for an overfill / explosion scenario involving the gasoline storage tanks. A full list of the Buncefield recommendations is reproduced in Appendix C. Based on the assessment, Caltex have adopted improved controls for tankage. A number of listed controls are already in place with the others to be implemented during the Terminal transition. 15 May 2013 Page 28 of 43

Table 7: Tank Overfill / Explosion Controls Type of Control Controls Prevention controls Primary level indication with high level alarm (radar gauge) Independent level indication with high-high level alarm Independent SIL-rated trip of tank inlet valve on high-high-high level alarm Tank design and maintenance program in accordance with industry good practice Continuous monitoring of tank inventory from a centralised control room Operating procedures controlling quantity of material transferred Classification of hazardous areas and selection of equipment and protective systems is conducted in accordance with Australian Standards HB13-2007 and AS2381 All tanks have installed earthing and maintenance program Detection Flammable gas detectors and control room alarms for tank compounds of low flash point flammable liquids Remote CCTV monitoring for tank compounds of low flashpoint flammable liquids Tank top infra-red flame detection for low flash point flammable liquid storage tanks Routine operator tank farm inspections Isolation Remote-actuated fire-rated tank inlet / outlet valves Spill Response Bund capacity, design and construction equivalent compliance to AS1940 Primary response capability to apply foam up to, and including, full bund surface area of largest tank compound Tank bund drainage isolation valves operable external to bund Event Response Tank separation distances compliant to s5.7 of AS1940. Caltex personnel trained in advanced fire fighting techniques, specific Caltex equipment and incident management approach common to Fire & Rescue NSW. Facility Emergency Plan & Pre-incident plans. The fault tree analysis considered those controls that would directly act to prevent the tank overfill (e.g. tank level indication with high level alarm) or limit the amount of material released (e.g. gas detector linked to an alarm). For each control, the effectiveness was determined by quantifying the reliability of individual components. Where controls relied on human intervention, the derived effectiveness accounted for the probability of operator error within the time required to respond. The event tree analysis estimated the frequency of an explosion resulting from the ignition of a significantly large vapour cloud formed following an overfill. In assessing the outcome frequency, the following factors were considered: Ignition probability; The probability of stable weather conditions (i.e. atmospheric stability category F); and The probability of a low wind speed that would result in the formation of a significantly large vapour cloud. The explosion event frequency was estimated to be less than 0.01 in a million per year (<1 10-8 per year). This event is not considered to be a significant contributor to the overall risk profile. In comparison, the average risk of fatality from a lightning strike is 0.1 in a million per year (1 10-7 per year) [2]. 15 May 2013 Page 29 of 43

9 CONSEQUENCE ANALYSIS For each hazardous scenario, consequence modelling was conducted for a range of hole sizes. The consequence modelling determined the area impacted by each consequence event. The consequence modelling was conducted using the software package PHAST-RISK [5]. The models within PHAST-RISK were used to determine the consequence impact distances for the heat radiation from the pool fires. The consequence impact distances for each effect type depends on the following conditions: Release conditions (temperature, pressure, hole size and duration) Release source (elevation, orientation) Chemical properties Atmospheric conditions (wind speed). Independent of their likelihood, several pool fire events and the VCE events were considered to have potential to cause an off-site fatality and / or injury. These results are summarised in Table 8, grouped by MAH. Table 9 lists a number of locations along the facility boundary where the MAHs have the potential for off-site fatality. Of these locations, only those positions adjacent to storage tanks are impacted by the scenarios considered in the QRA model. Table 8: Consequence Events with Off-site Fatality or Injury Impact MAH Related Isolatable Consequence Sections Description Storage tanks adjacent the "Very large" spill fire OMC-002, OMC-003 North-Eastern, Eastern and Western boundaries Full-surface bund fire OMC-002, OMC-003 Transfer pipelines between Fire following a large wharf and terminal pipeway release from pipeline OMC-002 Storage tanks near the VCE following a tank North-Eastern and Eastern overfill event boundaries Offsite Impact Injury Only Fatality and injury Fatality and injury Fatality and injury Table 9: Off-site Locations Potentially Impacted by MAH Scenarios Location Event Type MAH No. Intersection of Silver Beach Road and Captain Cook Drive Not impacted Kurnell Social Club Not impacted Cook Street Boundary Full-surface bund fire OMC-002 VCE following a tank overfill event OMC-002 Reserve Road Boundary Full-surface bund fire OMC-002 VCE following a tank overfill event OMC-002 National Park Boundary VCE following a tank overfill event OMC-002 Chisholm Rd Commercial Premises Full-surface bund fire OMC-003 Sir Joseph Banks Drive Boundary Not impacted HCE Boundary Full-surface bund fire OMC-003 To provide guidance on the impact experienced from different fire events, the downwind impact distance for a number of consequences are presented in Table 10. These are measured from the centre point of the storage. 15 May 2013 Page 30 of 43

Table 10: Typical Impact Distances for Fire Scenarios Event Distance to fatality (approx 12.5 kw/m 2 ) Full surface tank fire up to 50 m Typically not reached at diameter ground level outside of bund Full surface tank fire up to 78 m Typically not reached at diameter ground level outside of bund Distance to injury (approx 4.7 kw/m 2 ) Typically not reached at ground level outside of bund Typically not reached at ground level outside of bund Full bund fire up to 8000 m 2 62 m 130 m Full bund fire up to 25,500 m 2 101 m 194 m Fire from catastrophic failure of any transfer pipeline Fire from catastrophic failure of any loading arm 26 m 60 m 20 m 35 m Due to the relative height of the storage tanks and the observer, the heat flux radiation experienced from a full-surface tank fire does not exceed injury levels under average weather conditions. 15 May 2013 Page 31 of 43

10 RISK ASSESSMENT 10.1 INDIVIDUAL RISK - FATALITY Individual risk was determined by combining the frequency and consequence data for each hazardous scenario. Individual risk contours were developed by plotting lines that connect different locations experiencing the same levels of risk. The individual risk of fatality contours are presented in Figure 7. Cook Street Refinery Boundary Reserve Road Refinery Boundary Chisholm Road Refinery Boundary Figure 7: Location-Specific Individual Risk of Fatality (Off-site Assessment) The risk results were compared to the risk criteria to determine the tolerability of the risk from the proposed operations. The particular aspects of the risk criteria applicable to this study were [2]: Hospitals, schools, child-care facilities and old age housing development should not be exposed to individual fatality risk levels in excess of 0.5 x 10-6 per year. 15 May 2013 Page 32 of 43

Residential developments and places of continuous occupancy, such as hotels and tourist resorts, should not be exposed to individual fatality risk levels in excess of 1 x 10-6 per year. Commercial developments, including offices, retail centres, warehouses with showrooms, restaurants and entertainment centres, should not be exposed to individual fatality risk levels in excess of 5 x 10-6 per year. Sporting complexes and active open space areas should not be exposed to individual fatality risk levels in excess of 10 x 10-6 per year. Individual fatality risk levels for industrial sites at levels of 50 x 10-6 per year should, as a target, be contained within the boundaries of the site where applicable. The 0.5 x 10-6 per year risk contour extends off-site in some areas but does not extend to sensitive areas such as the pre-school, which is located to the north of the Terminal boundary on Captain Cook Drive. This aspect of the criteria is therefore satisfied. The 1 x 10-6 per year risk contour extends off-site in some areas but does not extend to residential areas. This aspect of the criteria is therefore satisfied. The 5 x 10-6 per year risk contour extends off-site in some areas but does not extend to commercial developments. This aspect of the criteria is therefore satisfied. The 10 x 10-6 per year risk contour extends off-site in some areas but does not extend to active open space such as the Kurnell Recreational Club, which is located to the west of the Terminal boundary on Captain Cook Drive. This aspect of the criteria is therefore satisfied. The analysis has found the 50 x 10-6 per year individual risk level does not exceed the site boundary. This aspect of the criteria is therefore satisfied. The tolerability of the fatality risk results is summarised in Table 11. Table 11: LSIR Fatality Risk Tolerance Criteria [2] Tolerance Criteria Land Use (risk in a million per year) Sensitive areas, such as hospitals and schools 0.5 Residential developments and continuous occupancy, such as hotels and resorts 1.0 Commercial developments, including retail centres, offices and entertainment centres 5 Sporting complexes and active open space 10 Industrial areas 50 LSIR Results The relevant LSIR contours do not extend to each of these areas. All criteria are satisfied. The model was used to determine the consequence events that contribute to the risk at different locations along the boundary. Risk contributors were identified at locations corresponding to the Reserve Road Boundary and the Chisholm Rd boundary (refer to Figure 7). The risk contributors at these locations are presented in Table 12. 15 May 2013 Page 33 of 43

Table 12: Risk Contributors Location Contributing Consequence Event MAH No. Risk Contribution Full-surface bund fire associated with storage tanks near the northeastern OMC-002 98% and eastern boundaries Reserve Road VCE following a tank overfill event Refinery Boundary associated with storage tanks near OMC-002 2% the north-eastern and eastern boundaries Full-surface bund fire associated with storage tanks near the northeastern OMC-002 98% and eastern boundaries Cook Street Refinery Boundary Chisholm Road Refinery Boundary VCE following a tank overfill event associated with storage tanks near the north-eastern and eastern boundaries Full-surface bund fire associated with storage tanks near the western boundary OMC-002 2% OMC-002 100% 15 May 2013 Page 34 of 43

10.2 INDIVIDUAL RISK - INJURY The injury risk results were generated by applying the impairment criteria defined in Section 6.2. The resulting individual risk of injury contour for heat radiation is presented in Figure 8. A corresponding individual risk of injury contour for explosion overpressure is not presented because the explosion event frequency is below the criterion level. Figure 8: Location-Specific Individual Risk of Injury Heat Radiation (50 x 10-6 per year) 15 May 2013 Page 35 of 43

The tolerability of results was determined by comparison with the HIPAP4 injury risk criteria [2]. As the consequence events analysed were pool fires and an explosion resulting from a tank overfill event (i.e. no toxic vapour dispersion), the particular aspects of the risk criteria applicable to this study were: Heat flux radiation at residential and sensitive land-use areas should not exceed 4.7 kw/m 2 at a frequency of more than 50 x 10-6 per year. Explosion overpressure at residential and sensitive land-use areas should not exceed 7 kpa at frequencies of more than 50 x 10-6 per year. The 50 x 10-6 per year individual risk of injury risk contour for heat flux radiation is mostly contained on-site, only extending beyond boundary in the north-east section of the terminal. However, it does not reach residential areas or sensitive areas (e.g. the pre-school, which is located to the north of the terminal on Captain Cook Drive). This aspect of the criteria is therefore satisfied. The risk of explosion calculated for a tank overfill event was below 50 x 10-6 per year. Consequently, an injury risk plot for explosion overpressure is not presented, as the risk does not exceed the criteria level of 50 x 10-6 per year at any location. This aspect of the criteria is therefore satisfied. The injury risk criteria for toxic exposure was not applicable, as the QRA did not involve scenarios which could result in this type of event. The acceptability of the injury risk criteria is summarised in Table 1. Table 13: LSIR Injury Risk Tolerance Criteria [2] Tolerance Criteria Individual Injury Risk Criteria (risk in a million per year) Incident heat flux radiation at residential and sensitive areas exceeding 4.7 kw/m 2 50. Incident explosion overpressure at residential and sensitive use areas should 50 not exceed 7 kpa at frequencies. Toxic concentrations in residential and sensitive use areas exceed a level which would be seriously injurious to sensitive 10 members of the community following a relatively short period of exposure. Tolerability The relevant LSIR contours do not extend to these areas. The criteria is met. Not applicable, as the QRA did not involve scenarios which could result in this type of event. 15 May 2013 Page 36 of 43

10.3 SOCIETAL RISK OFF-SITE POPULATION The societal risk exposure for the off-site population was assessed using an F-N curve and the indicative societal risk criteria described in HIPAP4 [2]. The F-N curve for the Project is presented in Figure 9, which also shows the indicative societal risk criteria. 1.00E-01 Frequency of N or more fatalities (F, /year) 1.00E-02 1.00E-03 1.00E-04 1.00E-05 1.00E-06 1.00E-07 1.00E-08 Negligible ALARP Intolerable 1.00E-09 1 10 100 1000 Number of Fatalities (N) Figure 9: Societal Risk Results Off-site Population As can be seen from Figure 9, the F-N curve lies below the negligible line. In this region, the societal risk is not considered significant, provided other individual risk criteria are met. As described in the preceding sections, the individual risk criteria for fatality and injury are satisfied and therefore the societal risk is also considered tolerable. 10.4 RISK OF PROPERTY DAMAGE AND ACCIDENT PROPAGATION The risk of property damage and accident propagation was assessed using the impairment criteria defined in Section 6.4. The resulting risk contour for heat radiation is presented in Figure 10. A corresponding risk contour for explosion overpressure is not presented because the explosion event frequency is below the criterion level. 15 May 2013 Page 37 of 43

Figure 10: Location-Specific Risk of Property Damage and Accident Propagation Heat Radiation (50 x 10-6 per year) The tolerability of results was determined by comparison with the following risk criteria defined within HIPAP4 [2]: Incident heat flux radiation at neighbouring potentially hazardous installations or at land zoned to accommodate such installations should not exceed a risk of 50 x 10-6 per year for the 23 kw/m 2 heat flux level. 15 May 2013 Page 38 of 43

Incident explosion overpressure at neighbouring potentially hazardous installations, at land zoned to accommodate such installations or at nearest public buildings should not exceed a risk of 50 x 10-6 per year for the 14 kpa explosion overpressure level. The 50 x 10-6 per year risk contour for heat flux radiation is contained on-site. Therefore, it does not reach neighbouring areas, including potentially hazardous installations. This aspect of the criteria is satisfied. In Figure 10, the 50 x 10-6 per year risk contour appears as numerous individual sections of the same contours that are limited to the immediate area. For example, within the Tank Farm, different sections of the contours are contained within the corresponding bunded area. This demonstrates that these contours do not extend to impact surrounding infrastructure, such as storage tanks within adjoining areas. The risk of explosion at the facility did not exceed 50 x 10-6 per year. Consequently, a risk plot for explosion overpressure is not presented, as the risk does not exceed the criteria level of 50 x 10-6 per year at any location. This aspect of the criteria is therefore satisfied. The acceptability of the risk criteria is summarised in Table 1. Table 13: Risk of Property Damage And Accident Propagation Tolerance Criteria [2] Tolerance Criteria Risk Criteria (risk in a million per Tolerability year) Incident heat flux radiation at neighbouring potentially hazardous installations or at land zoned to accommodate such installations for the 23 kw/m 2 heat flux. 50 The relevant LSIR contours Incident explosion overpressure at do not extend to these neighbouring potentially hazardous areas. The criteria are installations, at land zoned to met. 50 accommodate such installations or at nearest public buildings for the 14 kpa explosion overpressure level 10.5 BIOPHYSICAL RISK The risk to the biophysical environment examines the potential effects on the long-term viability of the ecosystem or any species within it. The risk was assessed by examining release scenarios associated with the operations of the facility. In assessing the potential impact, the analysis considered the controls that would prevent, or mitigate, the impact an incident could have on the surrounding environment. For the wharf, the QRA identified release scenarios at the product loading arms and the pipelines along the wharf. A release from this equipment could affect the marine environment of Botany Bay. However, there are a number of controls in place that would minimise the potential for a release. The equipment items are subject to testing and inspection programs, in line with Caltex integrity management programs. During unloading operations, there are personnel in attendance who, if a release occurred, would be able to detect the leak and isolate the source. Additionally, a spill at the loading arms would be contained within the purpose-built spill containment areas. These factors will limit the amount of material that would typically be released following a failure. A release of product at the wharf is not considered likely to threaten the long-term viability of the ecosystem. For the tank farm, the QRA identified release scenarios at the product storage tanks, as well as the associated pipelines and pumps. The potential for release from this equipment is managed by Caltex through a maintenance program to ensure the integrity of equipment. If a release occurs, it would be contained within the bunded areas surrounding storage tanks and pumps or within the pipeways. Impacts to surrounding ecosystems would be negligible. A release would be identified by the spill 15 May 2013 Page 39 of 43

detection within the Terminal that includes routine operator surveillance, routine dead tank monitoring and flammable vapour detection. An appropriate response would then be activated to clean-up a spill. Additionally, the containment areas can be drained to the oily water system, where product would be retained, preventing the discharge of any remaining product direct to the environment. Therefore, a release of product within the terminal would not threaten the long-term viability of the ecosystem. Caltex also maintains an Environmental Aspects and Impacts Register, as part of its requirements for compliance with ISO 14001 [22]. The register identifies potential sources of accidental release, assesses the potential consequence, identifies key risk controls and ranks the risk using Caltex s Riskman2 process. 10.6 SENSITIVITY ANALYSIS QRA models are developed based on a number of assumptions with some assumptions being more influential than others. The assumptions used in the current study were reviewed to determine those that could influence the risk results. Assumptions related to the following areas were considered most influential: Frequency Data, including modification factor and utilisation Pool Fire Modelling; and Heat Radiation Vulnerability. The frequency data used in the analysis was obtained from available public source. For reasons outlined in Section 8.1, this frequency data was applied in the QRA without modification. A sensitivity analysis was conducted to determine the influence possible modifications would have in the results. This analysis involved doubling the frequency used in the model, i.e. a doubling of the failure rate. Although there was a change in the individual risk of fatality contours, these changes did not result in any of the risk contours exceeding the applicable criteria and therefore the conclusions made regarding risk tolerability were unchanged. A number of assumptions were made concerning the modelling of pool fires. The magnitude of the pool fire consequences depends on the selected representative material, operating pressure and spill containment size. Of these parameters, the greatest variable observed is the operating pressure (and tank level), which influences the release rate and pool fire size. While a change in pressure or level would result in large pool forming, the physical spill containment would limit the pool size and subsequent fire size. Adjustment of related assumptions causes an increase in the risk contours most influenced by the medium to large releases. However, these effects are limited to on-site areas and the risk off-site is not altered significantly. The conclusions made regarding risk tolerability remained unchanged. The heat radiation vulnerability model and corresponding exposure time selected for use in the QRA are other assumptions that would influence the risk results. The vulnerability model is used to determine the fatality impact based on the calculated heat flux and an assumed exposure time (refer to Assumption No. 13 in Appendix A). This study used the model developed by TNO for "unprotected" personnel. An alternate choice is the Eisenberg equation, however, a higher heat flux is required to obtain the same fatality impact assuming the same exposure time. Therefore, the parameter of greater influence is exposure time. A longer exposure time would results in a higher fatality for the same heat flux. The exposure time would have to be at least doubled before the risk results would be increased to the extent that may alter the conclusions regarding risk tolerability. In summary, the sensitivity of the QRA model to various parameters was reviewed. Significant variations to these assumptions were investigated. The overall conclusions of the QRA model regarding risk tolerability remained unchanged despite these modifications to the QRA model. 15 May 2013 Page 40 of 43

11 COMPARISON TO RISK AT THE EXISTING FACILITY The conversion to terminal operations results in a significant reduction in the number of major accident scenarios at the site due to the shut-down of the refinery process units. Following conversion to terminal operation, there will be a general reduction in the extent of the off-site risk. This reduction can be attributed to the following factors: Shut-down of refinery process units results in the decommissioning of the LPG storage area (and the associated pipe network). Under refinery operations, LPG storage areas were in close proximity to the site boundary and several release scenarios had the potential to impact off-site areas. The change to terminal operations will eliminate these scenarios. Shut-down of refinery process units results in the ceasing of operations involving toxic material, such as chlorine and hydrogen sulphide. In previous studies, large release scenarios involving these materials had the potential to extend into off-site areas. The change to terminal operations will eliminate these scenarios. Reduced potential for events with far-reaching impacts such as boiling liquidexpanding vapour explosion (BLEVE) scenarios. Due to the removal of liquefied gas inventories, the potential for BLEVEs will be eliminated. Removal of these hazardous inventories will also significantly reduce the number of potential VCEs. A significant reduction in the inventory of flammable and combustible liquids. While the site will retain approximately 60% of the existing tankage, the hazardous inventories within the refinery process units will be eliminated. Modifications to storage tank operations. The individual risk of fatality will be reduced at certain locations as a result of; o Conversion of some tankage close to the site boundary to less hazardous duty (e.g. crude tanks converted to diesel) o The commitment to improved risk controls at some locations as a result of implementing the Project (e.g. automated overfill protection on gasoline tanks). 15 May 2013 Page 41 of 43

12 REFERENCES 1 State Environment Planning Policy No 33 - Hazardous and Offensive Development, published in Gazette No 36 of 13/03/1992, p 1754. 2 New South Wales Government, Department of Planning, Hazardous Industry Planning Advisory Paper No. 4, Risk Criteria for Land Use Safety Planning, January 2011 (HIPAP No. 4). 3 New South Wales Government, Department of Planning, Hazardous Industry Planning Advisory Paper No. 6, Hazard Analysis, January 2011 (HIPAP No. 6). 4 Caltex Refineries (NSW) Pty Ltd., "Caltex Kurnell Refinery Neighbourhood Layout, Drawing Number A1-127103, Revision 1. 5 Det Norske Veritas, PHAST-RISK (Safeti), Version 6.7, http://www.dnv.com/services/software/products/safeti/safeti/index.asp 6 Taveau, J., The Buncefield explosion: were the resulting overpressures really unforeseeable?, Process Safety Progress, Vol 31, No. 1, 2011. 7 Committee for the Prevention of Disasters, Methods for calculation of physical effects Part 2 Yellow Book CPR 14E, Third Edition, Chapter 5 Vapour Cloud Explosion, 2005. 8 DNV ENERGY, Illustrative model of a risk based land use planning system around petroleum storage sites, Buncefield Major Incident Investigation Board, Rev 0, May 2008. 9 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Automotive Diesel Fuel, Infosafe No. ACRJ8, November 2011. 10 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Fuel Oil, Infosafe No. AMQ17, May 2009. 11 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Jet A-1 Fuel, Infosafe No. AMQ36, September 2011. 12 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Super Premium Unleaded Petrol of 98 RON, Infosafe No. LPTL8, May 2009. 13 Caltex Refineries Pty Ltd, Material Safety Data Sheet, Unleaded Petrol, Infosafe No. AMPHO, May 2009. 14 CHRIS Manual (Chemical Hazards Response Information System), Oils: Diesel data sheet, US Department of Transportation / US Coast Guard, June 1999. 15 CHRIS Manual (Chemical Hazards Respo nse Information System), Oils, Fuel: 4 data sheet, US Department of Transportation / US Coast Guard, June 1999. 16 Caltex Refineries (NSW) Pty. Ltd. Drawing, Plant 10 -Wharf Breasting Island Upper Deck Spill Containment Area, Dwg No. 147999, Rev 0, 14 September 2012. 17 Buncefield Major Incident Investigation Board, The Buncefield Incident 11 December 2005, The Final Report of the Major Incident Investigation Board, December 2008 18 UK Health and Safety Executive, Buncefield Explosion Mechanism Phase 1, RR718, 2009. 15 May 2013 Page 42 of 43

19 UK HSE, Failure Rate and Event Data for use within Land Use Planning Risk Assessments, 2000. 20 International Association of Oil & Gas Producers, OGP Risk Assessment Data Directory; Storage Incident Frequencies, Report No. 434-3, March 2010. 21 E & P Forum, Hydrocarbon Leak and Ignition Data Base, Report No. 11.4/180, May 1999. 22 International Standards Organisation, ISO 14001:2004, Environmental management systems Requirements with guidance for use. 15 May 2013 Page 43 of 43

APPENDIX A ASSUMPTION REGISTER This appendix documents the technical assumptions made during the QRA. 15 May 2013 Page A.1 of 19

List of Assumptions Assumption No. 1: Study Boundaries...3 Assumption No. 2: Isolatable Sections...4 Assumption No. 3: Release Rates...5 Assumption No. 4: Representative Materials...6 Assumption No. 5: Pipe Lengths...7 Assumption No. 6: Frequency Data...8 Assumption No. 7: General Utilisation...9 Assumption No. 8: Wharf Utilisation...10 Assumption No. 9: Product Transfer Utilisation...11 Assumption No. 10: Ignition Probability...12 Assumption No. 11: Pool Fire Modelling...13 Assumption No. 12: Weather Data...15 Assumption No. 13: Heat Radiation Vulnerability...16 Assumption No. 14: Overpressure Impact...17 Assumption No. 15: Vulnerability Summary...18 Assumption No. 16 Off-site Population Data...19 15 May 2013 Page A.2 of 19

Assumption No. 1: Study Boundaries Category: Hazard Identification The QRA considered equipment containing/handling flammable or combustible liquids at the facility when operating as a Terminal. The major areas considered were: Atmospheric storage tanks within tank farms Wharf operations, including ship loading / unloading Internal pipelines involved in terminal operations Pumps involved in transfer of product. The hazards identified for the operation were the result of fabric failures, i.e. the failure of equipment due to corrosion, material / construction defects and design error. 15 May 2013 Page A.3 of 19

Assumption No. 2: Isolatable Sections Category: Hazard Identification An isolatable section is a system of pipes and / or equipment within the Terminal that contain hazardous materials. The isolatable section is bound by specific isolation points, such as valves that can be operated remotely from the control room. Where possible, emergency shutdown valves (ESDVs) were nominated as the isolation points, rather than control valves. 15 May 2013 Page A.4 of 19

Assumption No. 3: Release Rates Category: Consequence Analysis When modelling the effects associated with the identified hazardous scenarios, constant release rates were assumed. Release rates were calculated based on the material, hole size and operating temperature and pressure. Where appropriate, the calculated release rates were limited to the specified process flow rate through the corresponding pipeline. 15 May 2013 Page A.5 of 19

Assumption No. 4: Representative Materials Category: Consequence Analysis The material within an "isolatable section" was represented by a single representative hydrocarbon component for modelling purposes. In each case, the physical properties of the representative material were verified against the corresponding MSDSs provided by Caltex. The table below lists the representative materials used in the QRA. Material / Product Gasoline Fuel Oil ULP / PULP / SPULP Jet Fuel Diesel Slop* Representative Material n-octane n-eicosane n-octane n-dodecane n-hexadecane n-octane Slop was assumed to be a mixture of diesel and gasoline. For the purposes of this analysis where slop was modelled, it was assumed to have the same properties as gasoline. 15 May 2013 Page A.6 of 19

Assumption No. 5: Pipe Lengths Category: Equipment Design and Layout The analysis considered all internal pipelines involved in operations at the Terminal. This included pipelines connecting the wharf and storage tanks. The routes taken by the pipelines were shown on diagrams provided by Caltex. The lengths of the pipelines were estimated from the scaled facility plot plan. Impact: The piping dimensions have an impact on the frequency analysis conducted in the QRA. Pipe failure frequency is related to both the pipe size and pipe length. The failure frequency generally decreases as the pipe size increases and it increases with pipe length. The dimensions of the process piping also affect the inventory held within the pipe and therefore the amount of material that may be involved in a release. Reference: Site Plans detailing the equipment layout was provided by Caltex. 15 May 2013 Page A.7 of 19

Assumption No. 6: Frequency Data Category: Frequency Analysis The failure frequency data used in the QRA was generated by reviewing leak data associated with transfer process. This data was considered appropriate as the study mainly examines releases involving the various hydrocarbons stored at the Terminal. The failure frequency data used in the analysis is summarised in Appendix B. 15 May 2013 Page A.8 of 19

Assumption No. 7: General Utilisation Category: Frequency Analysis The Terminal was assumed to be in continuous operation, i.e. storage tanks always contained product. However, due to the nature of the operation, equipment items such as the ship loading arms (and connecting pipelines) would not be used continuously. The utilisation for this equipment was adjusted based on information provided by Caltex. 15 May 2013 Page A.9 of 19

Assumption No. 8: Wharf Utilisation Category: Frequency Analysis The failure frequency associated with the loading / unloading of material at the wharf was based on the number of shipments per year for terminal operation. Caltex provided data detailing the expected number of shipments for each product, as well as the number of movements involving the export of slop. For each material, the utilisation was determined using the following equation: % = ( ) % The total time to unload all shipment per year (for each material) was determined by the following: =. h h ( ) ( /h ) For all materials, shipment activities involved the use of two loading arms at the fixed berth on the wharf. Diesel will also be received at the submarine berth. For each product, the calculated utilisation was used to determine the failure frequency of the pipelines connecting the loading arms to the corresponding storage tanks. Additional scenarios were added representing the portion of the time that these pipelines were not in use (referred to as static ). For the static scenarios, the pipeline pressure was assumed to be based on the liquid head, i.e. the pipe elevation. 15 May 2013 Page A.10 of 19

Assumption No. 9: Product Transfer Utilisation Category: Frequency Analysis The utilisation of the pipelines used to transfer product from the storage tanks to the Banksmeadow fuel distribution terminal was determined. In terminal operations, a number of other pumps may be used for a range of operations within the facility. Caltex s expectation is that these pumps will be rarely used. These additional pumps have been included in the QRA with an utilisation of 1%. 15 May 2013 Page A.11 of 19

Assumption No. 10: Ignition Probability Category: Event Tree Analysis The following probability values were used to quantify ignition of different materials. These probabilities were used in the event tree analysis to determine the frequency of the resulting consequence events. The ignition probability used for flammable liquids is summarised in the table below. Leak Category Release Rate Probability of Ignition Minor < 1 kg/s 0.01 Major 1-50 kg/s 0.03 Massive > 50 kg/s 0.08 For combustible liquids, the ignition probabilities listed above were multiplied by 0.1 to reflect the lower chance of ignition due to the higher flash points of such materials. Reference A.W. Cox, F.P. Lees and M.L. Ang, Classification of Hazardous Locations, IChemE, 1993. 15 May 2013 Page A.12 of 19

Assumption No. 11: Pool Fire Modelling Category: Consequence Modelling For scenarios involving the release and ignition of a flammable or combustible liquid spill from tank farm operations, wharf operations or associated pipelines, the only outcome considered in the QRA was a pool fire. Due to ambient operating temperatures, a negligible amount of vapour flash, if any, would not occur. Therefore consequence types involving vapour dispersion (i.e. flash fires) were not considered. Depending on the location of the event on the site, limits were placed on the maximum pool size as follows: In the tank farm, the maximum pool fire diameter was limited by the bund area. In pipeways, the maximum pool fire diameter was limited to the width of the pipe trench. At the wharf, the maximum pool diameter was limited by the spill containment capability of the berth at the wharf (equivalent diameter of approximately 15 m). For pumps, the maximum pool fire diameter was limited by the area defined by surrounding kerbing. When modelling pool fires, the pool fire diameters were adjusted to account for the influence of the wind, which extends the fire downwind by a distance commonly referred to as the flame drag. For pool fire events, the average wind speed for the site was used to calculate the flame drag. Pool fires involving materials identified at the Terminal would produce smoky flames. These fires were are modelled within PHAST by setting the flame type to "smoky", which makes use of the following equation: = + Equation 1 Units: Surface emissive power of flame ( ) W/m 2 Maximum luminous emissive power ( ) W/m 2 Smoke emissive power ( ) W/m 2 Characteristic length for decay of ( ) m Flame diameter (D) m In calculating the radiant heat, the model considers the fraction of radiation emitted from a flame that is not absorbed by the atmosphere before reaching the observer. This parameter is referred to as the atmospheric transmissivity ( ), which defined as follows: =.. [ ( )]. [ ( )]. [ ( )] +. [ ( )] Equation 2 The adsorption coefficients for water vapour ( ( )) and carbon dioxide ( ( )) are defined as follows: ( ) =. Equation 3 ( ) = Equation 4 Units: Water vapour pressure ( ) Pa Distance from flame surface to observer ( ) m Atmospheric temperature ( ) K 15 May 2013 Page A.13 of 19

Reference: Mudan K.S. & Croce P.A., "Fire Hazard Calculations for Large Open Hydrocarbon Fires", The SFPE Handbook of Fire Protection Engineering, 1st Edition, 1988. Harper, M., "POLF (Pool Fire) Theory Document", DNV, London, October 2005. Harper, M., "EXPS Theory Document", DNV, London, October 2005. 15 May 2013 Page A.14 of 19

Assumption No. 12: Weather Data Category: Consequence Modelling / Risk Analysis The meteorological data used in the analysis was derived from 10-minute weather observations taken by Caltex at the Kurnell Refinery. Six atmospheric stability classes / wind speed combinations were considered used in the analysis, coupled with 16 wind directions. The probability of each atmospheric stability class / wind speed combination occurring during the daytime was also determined for use in societal risk calculations. The probability distribution is provided below. Stability Category A/B C D L D U E F Average Conditions Wind Speed (m/s) 3.0 3.6 3.5 6.2 3.5 1.9 3.5 Temperature (C) 23.7 20.9 18.9 18.4 17.3 15.6 18.5 Relative Humidity (%) 56% 61% 74% 69% 73% 79% 71% Probability 8% 17% 18% 17% 12% 27% 100% Direction Probability of Wind Direction N 0.063 0.042 0.027 0.001 0.021 0.092 0.045 NNE 0.040 0.036 0.052 0.006 0.127 0.136 0.072 NE 0.105 0.139 0.087 0.080 0.108 0.069 0.094 ENE 0.142 0.090 0.054 0.003 0.021 0.034 0.050 E 0.107 0.052 0.057 0.010 0.026 0.034 0.043 ESE 0.073 0.055 0.086 0.044 0.044 0.017 0.048 SE 0.038 0.026 0.054 0.070 0.029 0.013 0.037 SSE 0.039 0.041 0.130 0.111 0.083 0.014 0.067 S 0.042 0.044 0.066 0.143 0.049 0.009 0.056 SSW 0.029 0.056 0.067 0.272 0.049 0.009 0.080 SW 0.018 0.048 0.083 0.145 0.086 0.015 0.064 WSW 0.016 0.020 0.033 0.027 0.072 0.039 0.034 W 0.012 0.054 0.036 0.043 0.105 0.080 0.058 WNW 0.030 0.068 0.041 0.019 0.073 0.118 0.066 NW 0.081 0.107 0.055 0.012 0.052 0.156 0.086 NNW 0.165 0.121 0.072 0.013 0.056 0.166 0.102 Daytime Probability 1.00 1.00 0.72 0.64 0.00 0.00 0.50 Reference: CALMET files provided by Caltex for between 2003 to 2007 (2007 10 minute met.txt). 15 May 2013 Page A.15 of 19

Assumption No. 13: Heat Radiation Vulnerability Category: Risk Analysis The following probit equation was used in the analysis to quantify the probability of fatality for individuals exposed to heat radiation from a pool fire: =. +. Equation 5 Units: Thermal Radiation Intensity (I) W/m 2 Time (t) seconds Probit (Y) dimensionless The "unprotected" probit was used to assess off-site risk, since an off-site population would generally not be expected to be wearing protective clothing. In using the probit equations, a maximum exposure duration of 20 seconds was assumed. This value is an estimate of time taken for people to flee from harmful heat radiation. It considers the time to react (approximately 5 seconds) and the time to move away from the area impacted by high levels of heat radiation. References: Committee for the Prevention of Disasters, Methods for the determination of possible damage, CPR 16E Green Book, 1992. 15 May 2013 Page A.16 of 19

Assumption No. 14: Overpressure Impact Category: Risk Analysis The probability of fatality for individuals exposed to overpressure were defined for various levels of overpressure, as described below. The probabilities were based on guidance provided within HIPAP4. Explosion Overpressure Effect Probability of Fatality (Outdoors) 7 kpa (1 psi) Probability of injury is 10%. No fatality 0% 21 kpa (3 psi) 35 kpa (5 psi) 70 kpa (10 psi) 20% chance of fatality to a person in a building 50% chance of fatality for a person in a building and 15 % chance of fatality for a person in the open 100% chance of fatality for a person in a building or in the open 0% 15% 100% References: New South Wales Government, Department of Planning, Hazardous Industry Planning Advisory Paper No. 4, Risk Criteria for Land Use Safety Planning, January 2011 (HIPAP4). 15 May 2013 Page A.17 of 19

Assumption No. 15: Vulnerability Summary Category: Risk Analysis The table below details the impact that pool fire events may have on exposed personnel. The model used to calculate the impact depended on the location of the exposed personnel, which varied depending on the focus of the analysis. Impact Heat Radiation Overpressure Consequence Event Pool Fire VCE Outdoor <35 kw/m 2 : probit >35 kw/m 2 : 100% fatalities Based on guidance provided within HIPAP 4 Indoor <23 kw/m 2 : no fatalities >23 kw/m 2 : 100% fatalities API 752* * The probability of fatality was estimated based on the overpressure experienced and the building type. The building categories used were those defined in API 752, Management of Hazards Associated with Location of Process Plant Permanent Buildings, 2 nd edition, 2003. 15 May 2013 Page A.18 of 19

Assumption No. 16 Off-site Population Data Category: Societal Risk Calculations The societal risk calculations were based on population data provided by Caltex (refer to Appendix D). For different locations, the population data detailed the expected number of people present at different times of the day. These population changes were considered in the corresponding risk calculations. 15 May 2013 Page A.19 of 19

APPENDIX B FAILURE RATE DATA This appendix presents the failure frequency data used for each equipment item. For each equipment item, the failure frequency data for a range of failure modes was obtained from historical industry data. The failure modes are represented through a range of hole sizes. The use of failure frequency from historical industry data without adjustment was considered appropriate for this analysis. The UK HSE advises that adjustments should be made where, for example, an assessed process design has a particularly arduous operating conditions or, alternatively, provides increased reliability. However, no particular characteristics of the Terminal operations were identified that justified adjusting the failure frequency data. For example, the environmental factors experienced at the facility are standard for its type. No excessively harsh conditions are experienced that would cause failure modes, such as corrosion, to occur at significantly higher rates. Furthermore, the failure frequency data used in the QRA represent "typical" facilities with similar operations. For example, the sources used to define the atmospheric tank failure rate were obtained from a review of historical data for storage tank incidents. The reported data represents an average performance derived from facilities of various ages covering many management systems. Caltex will continue to use its established integrity management processes. These are based heavily upon industry standards. These processes are expected to ensure that the integrity management performance within the facility is equal to, or better than, the performance of the "typical" facility that the failure frequency data represents. Caltex also has established processes for corporate audits, insurance engineering surveys and external audits to provide assurance as to the effectiveness of these integrity management processes. Therefore, it is considered appropriate to assess the Terminal using historical data for a "typical" facility. 15 May 2013 Page B.1 of 6

B.1 LOADING ARMS FOR LIQUID CARGO The failure frequency for the transfer of liquid cargo at the wharf was based on loading/unloading arm failure rate from the UK HSE data [1]. Data is provided for the two failure sizes listed. Table B-1: Loading / Unloading Arm Failure Rate Hole Size (mm) Failure Rate [1] (per transfer operation) Equivalent to 10% of crosssectional area of Arm 2.9 10-5 Arm Diameter 3.2 10-6 B.2 ATMOSPHERIC STORAGE TANKS The atmospheric tank failure frequency for various release sizes was based on data from the UK HSE data [1] and the OPG Risk Assessment Directory detailing storage incident frequencies [2]. The frequency distribution was derived using the OGP data. Table B-2: Atmospheric Storage Tank Failure Rate Failure Rate Hole Size (mm) (per tank per year) 20 2.1 10-3 50 4.2 10-4 100 2.8 10-4 Rupture 5.0 10-6 Historical data was used to determine the frequency of full surface fires associated with different types of atmospheric storage tanks [2, 3]. Table B-3: Full-Surface Tank Fire Frequency Tank Type Event Description Fire Frequency (per tank per year) Floating Roof Full-Surface Tank Fire 1.2 10-4 Fixed Roof Fixed with Internal Floating Roof B.3 PROCESS PIPING Internal Explosion and Full- Surface Tank Fire Internal Explosion and Full- Surface Tank Fire 9.0 10-5 9.0 10-5 The overall frequency has been taken from the E&P Forum [4]. The total frequency was distributed to the representative hole sizes selected for the analysis by considering information presented in the Cox et al [5] and TNO [6]. Table B-4: Transfer Pipe (50mm < D 100mm) Failure Rate Hole Size (mm) Failure Rate (per metre-pipe year) 5 2.7 10-5 20 7.2 10-6 50 1.4 10-6 Pipe Diameter (100 mm) 3.6 10-7 15 May 2013 Page B.2 of 6

Table B-5: Transfer Pipe (100mm < D 150mm) Failure Rate Hole Size (mm) Failure Rate (per metre-pipe year) 5 2.7 10-5 20 7.2 10-6 50 1.4 10-6 100 1.8 10-7 Pipe Diameter (150 mm) 1.8 10-7 Table B-6: Transfer Pipe (150mm < D 300mm) Failure Rate Hole Size (mm) Failure Rate (per metre-pipe year) 5 2.0 10-5 20 5.4 10-6 50 1.1 10-6 100 1.4 10-7 Pipe Diameter (300 mm) 1.4 10-7 B.4 PUMPS The total failure frequency for pumps was taken from the OGP Risk Assessment Directory detailing process releases [7]. This source also provided information detailing the frequency distribution for a range of hole sizes. Table B-7: Centrifugal Pump Failure Rate [7] Process Pipe Diameter (D) Hole Size (mm) Failure Rate (per year) D 100 mm D > 100 mm 5 4.0 10-3 20 5.6 10-4 50 9.9 10-5 Pipe diameter 5.8 10-5 5 4.0 10-3 20 5.6 10-4 50 9.9 10-5 100 2.9 10-5 Pipe diameter 2.9 10-5 B.5 FLANGES The total failure frequency for flanges was taken from the OGP Risk Assessment Directory detailing process releases [7]. The data obtained from this source was distributed over the representative hole sizes selected for the analysis [5]. 15 May 2013 Page B.3 of 6

Table B-8: Flange Failure Rate Process Pipe Diameter (D) Hole Size (mm) Failure Rate (per year) D 50mm 50mm < D 100 mm 100 mm < D 150 mm D >150 mm B.6 MANUAL VALVES 5 3.0 10-5 20 1.2 10-5 5 3.4 10-5 20 6.9 10-6 5 4.4 10-5 20 9.5 10-6 5 7.0 10-5 20 1.4 10-5 The total failure frequency for manual valves was taken from the OGP Risk Assessment Directory detailing process releases [7]. This source was also used to distribute the frequency between the representative hole sizes selected for the analysis. Other sources were not used, as those reviewed do not make a distinction between valve types. Table B-9: Manual Valve Failure Rate Manual Valve Size (D) Hole Size (mm) Failure Rate (per year) D 20 mm 20 mm < D 50 mm 50 mm < D 100 mm 100 mm < D 150 mm D >150 mm 5 2.6 10-5 20 8.2 10-6 5 2.6 10-5 20 5.0 10-6 50 3.2 10-6 5 3.4 10-5 20 6.9 10-6 50 1.5 10-6 100 2.0 10-6 5 4.2 10-5 20 8.6 10-6 50 1.8 10-6 100 6.3 10-7 150 1.8 10-6 5 5.2 10-5 20 1.1 10-5 50 2.6 10-6 100 9.3 10-7 300 2.0 10-6 15 May 2013 Page B.4 of 6

B.7 ACTUATED VALVES The total failure frequency for actuated valves was taken from the OGP Risk Assessment Directory detailing process releases [7]. This source was also used to distribute the frequency between the representative hole sizes selected for the analysis. Other sources were not used, as those reviewed do not make a distinction between valve types. Table B-10: Actuated Valve Failure Rate Actuated Valve Size (D) Hole Size (mm) Failure Rate (per year) D 20 mm 20 mm < D 50 mm 50 mm < D 100 mm 100 mm < D 150 mm D >150 mm B.8 INSTRUMENTATION 5 2.8 10-4 20 6.1 10-5 5 2.8 10-4 20 4.5 10-5 50 1.6 10-5 5 2.6 10-4 20 4.4 10-5 50 8.3 10-6 100 9.4 10-6 5 2.4 10-4 20 4.1 10-5 50 7.7 10-6 100 2.5 10-6 150 6.2 10-6 5 2.4 10-4 20 3.8 10-5 50 6.2 10-6 100 1.8 10-6 300 6.6 10-6 The total failure frequency for instrumentation was taken from the OGP Risk Assessment Directory detailing process releases [7]. Table B-11: Instrumentation Failure Rate Hole Size (mm) B.9 MIXERS FOR TANKS Failure Rate (per year) 5 2.3 10-4 20 5.9 10-5 The failure frequency data assumed for mixers connected to atmospheric tanks was based on the data used for centrifugal pumps [7]. This data was used to represent the possible failure modes involving a seal failure. A limited hole size distribution has been applied to reflect the likely failure modes associated with leaks for mixer seals. 15 May 2013 Page B.5 of 6

Table B-12: Atmospheric Storage Tank Mixer Failure Rate Failure Rate Hole Size (mm) (per tank per year) 5 4.0 10-3 20 7.2 10-4 B.10 REFERENCES 1 UK HSE, Failure Rate and Event Data for use within Risk Assessments, 2012. 2 International Association of Oil & Gas Producers, OGP Risk Assessment Data Directory; Storage Incident Frequencies, Report No. 434-3, March 2010. 3 LASTFIRE PROJECT, Large Atmospheric Storage Tank Fire Project, LASTFIRE Technical Working Group, June 1997. 4 E & P Forum, Hydrocarbon Leak and Ignition Data Base, Report No. 11.4/180, May 1992. 5 A.W. Cox, F.P. Lees and M.L. Ang, Classification of Hazardous Locations, IChemE, 1993, Table 18.1, page 39. 6 TNO, Guidelines for Quantitative Risk Assessment, Purple Book, CPR 18E, 2005. 7 International Association of Oil & Gas Producers, OGP Risk Assessment Data Directory; Process release frequencies, Report No. 434-1, March 2010. 15 May 2013 Page B.6 of 6

APPENDIX C BUNCEFIELD RECOMMENDATIONS This appendix provides information on the recommendations arising from the Buncefield investigation. A series of recommendations were by the Major Incident Investigation Board (MIIB) in relation to the design and operation of fuel storage sites [1]. The recommendations applicable to the facility are listed in the following table, grouped by subject. Design and operation of fuel storage sites RECOMMENDATION 1 Systematic assessment of safety integrity level requirements The Competent Authority and operators of Buncefield-type sites should develop and agree a common methodology to determine safety integrity level (SIL) requirements for overfill prevention systems in line with the principles set out in Part 3 of BS EN 61511. This methodology should take account of: the existence of nearby sensitive resources or populations; the nature and intensity of depot operations; realistic reliability expectations for tank gauging systems; and the extent/rigour of operator monitoring. Application of the methodology should be clearly demonstrated in the COMAH safety report submitted to the Competent Authority for each applicable site. Existing safety reports will need to be reviewed to ensure this methodology is adopted. RECOMMENDATION 2 Protecting against loss of primary containment using high integrity systems Operators of Buncefield-type sites should, as a priority, review and amend as necessary their management systems for maintenance of equipment and systems to ensure their continuing integrity in operation. This should include, but not be limited to reviews of the following: the arrangements and procedures for periodic proof testing of storage tank overfill prevention systems to minimise the likelihood of any failure that could result in loss of containment; any revisions identified pursuant to this review should be put into immediate effect; the procedures for implementing changes to equipment and systems to ensure any such changes do not impair the effectiveness of equipment and systems in preventing loss of containment or in providing emergency response. RECOMMENDATION 3 Protecting against loss of primary containment using high integrity systems Operators of Buncefield-type sites should protect against loss of containment of petrol and other highly flammable liquids by fitting a high integrity, automatic operating overfill prevention system (or a number of such systems, as appropriate) that is physically and electrically separate and independent from the tank gauging system. Such systems should meet the requirements of Part 1 of BS EN 61511 for the required safety integrity level, as determined by the agreed methodology. Where independent automatic overfill prevention systems are already provided, their efficacy and reliability should be reappraised in line with the principles of Part 1 of BS EN 61511 and for the required safety integrity level, as determined by the agreed methodology (see Recommendation 1). 15 May 2013 Page C.1 of 6

RECOMMENDATION 4 Protecting against loss of primary containment using high integrity systems The overfill prevention system (comprising means of level detection, logic/control equipm ent and independent means of flow control) should be engineered, operated and maintained to achieve and maintain an appropriate level of safety integrity in accordance with the requirements of the recognised industry standard for safety instrumented systems, Part 1 of BS EN 61511. RECOMMENDATION 5 Protecting against loss of primary containment using high integrity systems All elements of an overfill prevention system should be proof-tested in accordance with the validated arrangements and procedures sufficiently frequently to ensure the specified safety integrity level is maintained in practice in accordance with the requirements of Part 1 of BS EN 61511. RECOMMENDATION 6 Protecting against loss of primary containment using high integrity systems The sector should put in place arrangement to ensure the receiving site (as opposed to the transmitting location) has ultimate control over the tank filling. RECOMMENDATION 7 Protecting against loss of primary containment using high integrity systems The sector should undertake a review of the adequacy of existing safety arrangements, including communications, employed by those responsible for pipeline transfers of fuel. RECOMMENDATION 8 Protecting against loss of primary containment using high integrity systems The sector, including its supply chain of equipment manufacturers and suppliers, should review and report without delay on the scope to develop improved components and systems, including but not limited to the following: alternative means of ultimate high level detection systems that do not rely on components internal to the tank with the emphasis on ease of inspection, testing and maintenance; increased dependability of tank gauging systems should be explored through improved validation of measurements & trends, allowing warning of faults and using modern sensors with increased diagnostic capability; and systems to control and log override actions. RECOMMENDATION 9 Protecting against loss of primary containment using high integrity systems Operators of terminals should implement systems to ensure systematic maintenance of records pertaining to product movement and operation of the overfill prevention systems and any associated systems RECOMMENDATION 10 Protecting against loss of primary containment using high integrity systems The sector and regulators should agree on a system of lead and lag performance indicators for process safety performance. RECOMMENDATION 11 Engineering against escalation of loss of primary containment Operators of Buncefield-type sites should review the classification of places within COMAH sites where explosive atmospheres may occur and their selection of equipment and protective systems (as required by the Dangerous Substances and Explosive Atmospheres Regulations 2002). This review should take into account the likelihood of undetected loss of containment and the possible extent of an explosive atmosphere following such an undetected loss of containment. Operators in the wider fuel and chemicals industries should also consider such a review, to take account of events at Buncefield. 15 May 2013 Page C.2 of 6

RECOMMENDATION 12 Engineering against escalation of loss of primary containment Following on from Recommendation 11, operators of Buncefield-type sites should evaluate the siting and/or suitable protection of emergency response facilities such as fire fighting pumps, lagoons or manual emergency switches. RECOMMENDATION 13 Engineering against escalation of loss of primary containment Operators of Buncefield-type sites should employ measures to detect hazardous conditions arising from loss of primary containment, including the presence of high levels of flammable vapours in secondary containment. Operators should without delay undertake an evaluation to identify suitable and appropriate measures. This evaluation should include, but not be limited to, consideration of the following: installing flammable gas detection in bunds containing vessels or tanks into which large quantities of highly flammable liquids or vapour may be released; the relationship between the gas detection system and the overfill prevention system. Detecting high levels of vapour in secondary containment is an early indication of loss of containment and so should initiate action, for example through the overfill prevention system, to limit the extent of any further loss; installing CCTV equipment to assist operators with early detection of abnormal conditions. Operators cannot routinely monitor large numbers of passive screens, but equipment is available that detects and responds to changes in conditions and alerts operators to these changes. RECOMMENDATION 14 Engineering against escalation of loss of primary containment Operators of new Buncefield-type sites or those making major modifications to existing sites (such as installing a new storage tank) should introduce further measures including, but not limited to, preventing the formation of flammable vapour in the event of tank overflow. Consideration should be given to modifications of tank top design and to the safe re-routing of overflowing liquids. RECOMMENDATION 15 Engineering against escalation of loss of primary containment The sector should begin to develop guidance without delay to incorporate the latest knowledge on preventing loss of primary containment and on inhibiting escalation if loss occurs. This is likely to require the sector to collaborate with the professional institutions and trade associations. RECOMMENDATION 16 Engineering against escalation of loss of primary containment Operators of existing sites, if their risk assessments show it is not practicable to introduce measures to the same extent as for new ones, should introduce measures as close to those recommended by Recommendation 14 as is reasonably practicable. The outcomes of the assessment should be incorporated into the safety report submitted to the Competent Authority. RECOMMENDATION 17 Engineering against loss of secondary and tertiary containment The Competent Authority and the sector should jointly review existing standards for secondary and tertiary containment with a view to the Competent Authority producing revised guidance by the end of 2007. The review should include, but not be limited to the following: developing a minimum level of performance specification of secondary containment (typically this will be bunding); developing suitable means for assessing risk so as to prioritise the programme of engineering work in response to the new specification; formally specifying standards to be achieved so that they may be insisted upon in the event of lack of progress with improvements; improving firewater management and the installed capability to transfer contaminated liquids to a place where they present no environmental risk in the event of loss of secondary containment and fires; 15 May 2013 Page C.3 of 6

providing greater assurance of tertiary containment measures to prevent escape of liquids from site and threatening a major accident to the environment. RECOMMENDATION 18 Engineering against loss of secondary and tertiary containment Revised standards should be applied in full to new build sites and to new partial installations. On existing sites, it may not be practicable to fully upgrade bunding and site drainage. Where this is so operators should develop and agree with the Competent Authority risk-based plans for phased upgrading as close to new plant standards as is reasonably practicable. RECOMMENDATION 19 Operating with high reliability organisations The sector should work with the Competent Authority to prepare guidance and/or standards on how to achieve a high reliability industry through placing emphasis on the assurance of human and organisational factors in design, operation, maintenance, and testing. Of particular importance are: understanding and defining the role and responsibilities of the control room operators (including in automated systems) in ensuring safe transfer processes; providing suitable information and system interfaces for front line staff to enable them to reliably detect, diagnose and respond to potential incidents; training, experience and competence assurance of staff for safety critical and environmental protection activities; defining appropriate workload, staffing levels and working conditions for front line personnel; ensuring robust communications management within and between sites and contractors and with operators of distribution systems and transmitting sites (such as refineries); prequalification auditing and operational monitoring of contractors capabilities to supply, support and maintain high integrity equipment; providing effective standardised procedures for key activities in maintenance, testing, and operations; clarifying arrangements for monitoring and supervision of control room staff; and effectively managing changes that impact on people, processes and equipment. RECOMMENDATION 20 Operating with high reliability organisations Terminal operators should ensure the resulting guidance is fully implemented. RECOMMENDATION 21 Operating with high reliability organisations The sector should put in place arrangements to ensure that good practice in these areas, incorporating experience from other higher hazard sectors, is shared openly between organisations. RECOMMENDATION 22 Operating with high reliability organisations The regulator should ensure that MHF Safety Cases contain demonstration that good practice in human and organisational design, operation, maintenance and testing is implemented as rigorously as for engineering systems. RECOMMENDATION 23 Delivering high performance through culture and leadership The sector should set up arrangements to collate incident data on high potential incidents including overfilling, equipment failure, spills and alarm system defects, evaluate trends, and communicate information on risks, their related solutions and control measures to the industry. RECOMMENDATION 24 Delivering high performance through culture and leadership The arrangements set up to meet Recommendation 23 should include, but not be limited to, the following: thorough investigation of root causes of failures and malfunctions of safety and environmental protection critical elements during testing or maintenance, or in service; developing incident databases that can be shared across the entire sector, subject to data protection and 15 May 2013 Page C.4 of 6

other legal requirements. Examples exist of effective voluntary systems that could provide suitable models; collaboration between the workforce and its representatives, dutyholders and regulators to ensure lessons are learned from incidents, and best practices are shared. RECOMMENDATION 25 Delivering high performance through culture and leadership In particular, the sector should draw together current knowledge of major hazard events, failure histories of safety and environmental protection critical elements, and developments in new knowledge and innovation to continuously improve the control of risks. This should take advantage of the experience of other high hazard sectors such as chemical processing, offshore oil and gas operations, nuclear processing and railways. Emergency Arrangements RECOMMENDATION 1 Assessing the potential for a major incident Operators of Buncefield-type sites should review their emergency arrangements to ensure they provide for all reasonably foreseeable emergency scenarios arising out of credible major hazard incidents, including vapour cloud explosions and severe multi-tank fires that, before Buncefield, were not considered realistically credible. The Competent Authority should ensure that this is done. RECOMMENDATION 2 Managing a major incident on site The Competent Authority should review the existing COMAH guidance on preparing on-site emergency plans. This guidance needs to reflect the HSE s Hazardous Installations Directorate (HID) Chemical Industries Division inspection manual used by inspectors to assess the quality of the on-site plan in meeting the COMAH Regulations. In particular, reference should be made to the need to consult with health advisors and emergency responders. RECOMMENDATION 3 Managing a major incident on site For Buncefield-type sites, operators should review their onsite emergency plans to reflect the revised guidance on preparing on-site emergency plans as per Recommendation 2. The Competent Authority will need to check that this is done. RECOMMENDATION 4 Managing a major incident on site Operators should review and where necessary revise their on-site emergency arrangements to ensure that relevant staff are trained and competent to execute the plan and should ensure that there are enough trained staff available at all times to perform all the actions required by the on-site emergency plan. RECOMMENDATION 5 Managing a major incident on site For Buncefield-type sites, operators should evaluate the siting and/or suitable protection of emergency response facilities such as the emergency control centre, firefighting pumps, lagoons or manual switches, updating the safety report as appropriate and taking the necessary remedial actions. RECOMMENDATION 6 Managing a major incident on site Operators should identify vulnerable critical emergency response resources and put in place contingency arrangements either on or off site in the event of failure at any time of the year and make appropriate amendments to the on-site emergency plan. This should include identifying and establishing an alternative emergency control centre with a duplicate set of plans and technical information. RECOMMENDATION 7 Emergency preparedness, response & recovery For COMAH sites, if the operator relies on an off-site Fire and Rescue Service to respond, the operator s plan should clearly demonstrate that there are adequate arrangements in place between the operator and the service provider. The Competent Authority will need to check that this is done. 15 May 2013 Page C.5 of 6

RECOMMENDATION 8 Warning and informing the public COMAH site operators should review their arrangements to communicate with residents, local businesses and the wider community, in particular to ensure the frequency of communications meets local needs and to cover arrangements to provide for dealing with local community complaints. They should agree the frequency and form of communications with local authorities and responders, making provision where appropriate for joint communications with those bodies. RECOMMENDATION 9 Warning and informing the public The Competent Authority should review the COMAH guidance to assist operators in complying with Recommendation 8 and should work with the Cabinet Office to integrate the COMAH guidance and the CCA Communicating with the public guidance, so that communications regarding COMAH sites are developed jointly by the site operator and the local emergency responders. RECOMMENDATION 12 Preparing for and responding to a major incident off site Communities and Local Government should complete and, where necessary, initiate an assessment of the need for national-level arrangements to provide, fund and maintain, emergency response equipment (such as high volume pumps, firefighting foam and specialist pollution containment equipment). The review could also consider criteria for allocation and use of this equipment across the UK. RECOMMENDATION 23 Responding to a major incident The operators of industrial sites where there are risks of large explosions and/or large complicated fires should put in place, in consultation with fire and rescue services at national level, a national industry fire service mutual aid arrangement. The aim should be to enable industry equipment, together with operators of it as appropriate, to be available for fighting major industrial fires. Industry should call on the relevant trade associations and working group 6 of the Buncefield Standards Task Group to assist it, with support from CCS. The COMAH Competent Authority should see that this is done. C.1 REFERENCES 1 Buncefield Major Incident Investigation Board, The Buncefield Incident 11 December 2005, The Final Report of the Major Incident Investigation Board, December 2008. 15 May 2013 Page C.6 of 6

APPENDIX D OFF-SITE POPULATION DATA D.1 INTRODUCTION This appendix outlines the population data used in calculating the off-site societal risk F-N curve. The population data used in the model is presented in Table D-1. This data was developed from information provided by Caltex [1]. The terms referred to in the table are defined as follows: Off-site location Daytime Population Night Time Population Raw Data Modelled Population The off-site location of personnel in proximity to the Terminal. The off-site population during the daytime (i.e. between the hours of 6 am to 6 pm). The off-site population during the night time (i.e. between the hours of 6 pm to 6 am). The off-site population data provided by Caltex to R4Risk. The population data used in the analysis. Each of the listed off-site locations is identified in Figure 1. neighbourhood surrounding the facility [1]. This shows the layout of the The residential areas around the Terminal were subdivided as shown in Figure 2. The population density used for the residential areas was based on the Department of Planning data. This data indicated that the residential population density was approximately 2 people per house for an average block size of 750 m 2. The residential population was assumed to be fully present during night time and non-work hours, with a 75% reduction in the overall population during work hours. It was assumed that the residential population would be located indoors 70% of the time during the daytime and 95% of the night-time. The residential density was applied to the off-site locations referred to as "Residential West" and "Residential North". The total population of these areas was calculated by multiplying the density by the area covered. For the eastern residential areas, a more detailed approach was used to estimate the population due to the close proximity of this area to the Terminal boundary. In these areas, an occupancy of 2 persons per block was assumed. The Energy Australia site was also excluded from the off-site societal risk calculations because it is typically an unpopulated site. 15 May 2013 Page D.1 of 5

D.2 POPULATION DATA Table D-1: Population Data for Off-site Areas Off-site Location HCE Agility Light Industrial Area, adjacent to Terminal Boundary Daytime Population Modelled Raw Data Population Day shift (weekdays): 8 to 10 persons 105 car spaces for the site 79 cars counted. 5 outdoor 5 indoor 79 people with 95% indoor (i.e. 4 outdoor, 75 indoor) Night Time Population Modelled Raw Data Population Night shift and Dayshift 1 outdoor (weekends) 2 1 indoor persons No night time population data POPE licensed for 258 people 0 Kurnell Recreation Club Pre-School Botany Bay National Park Caltex Service Station POPE licensed for 258 people Kurnell Rec. Club - typical population is: Number of people during the day = 30 Average number of people at night = 50-60 Number of people on Friday night: ~100 32 people with 80% indoor 400,000 persons per calendar year to the park, with peak season being June to July for Whale season, and Christmas and new year periods. 3 10 outdoor 20 indoor 6 outdoor 26 indoor Approximately 110 people per day 110 outdoor 0 indoor 1 outdoor 2 indoor Kurnell Rec. Club - typical population for the Kurnell Rec. Club is: Number of people during the day = 30 Average number of people at night = 50-60 Number of people on Friday night ~100 No night time population No night time population 3 15 outdoor 45 indoor 0 0 1 outdoor 2 indoor Pizzas with Muscle 3 0 outdoor 3 indoor No night time population 0 Kurnell Pharmacy 3 0 outdoor 3 indoor No night time population 0 Kurnell Cellars 3 0 outdoor 3 indoor No night time population 0 Kurnell Fresh Food Supplies 3 0 outdoor 3 indoor No night time population 0 Kurnell Medical Centre 3 0 outdoor 3 indoor No night time population 0 Kurnell Grocery 3 0 outdoor 3 indoor No night time population 0 15 May 2013 Page D.2 of 5

Off-site Location Captains Pies and Cakes Kurnell Art Gallery - 6 Prince Charles Parade Real Estate - 7 Captain Cook Drive, Kurnell Endeavour Coffee & Ice Cream - 2 Prince Charles Parade Residential East Residential Central Residential West Daytime Population Modelled Raw Data Population 3 3 3 3 Department of Planning Data: Block of land size = 750 m 2 ~2 people per house 25% of population for day time Residential East estimated area = 173,500 m 2 Department of Planning Data: Block of land size = 750 m 2 ~2 people per house 25% of population for day time Residential East estimated area = 133,486 m 2 Department of Planning Data: Block of land size = 750 m 2 ~2 people per house 25% of population for day time Residential East estimated area = 285,156 m 2 0 outdoor 3 indoor 0 outdoor 3 indoor 0 outdoor 3 indoor 0 outdoor 3 indoor 35 outdoor 81 indoor 27 outdoor 62 indoor 133 outdoor 57 indoor Night Time Population Modelled Raw Data Population No night time population No night time population No night time population No night time population 463 356 761 0 0 0 0 23 outdoor 440 indoor 18 outdoor 338 indoor 38 outdoor 723 indoor 15 May 2013 Page D.3 of 5

Figure 1: Locations of Off-Site Populations 15 May 2013 Page D.4 of 5

Figure 2: Locations of Residential Areas D.3 REFERENCES 1 Email from Marian Magbiray (Caltex) to Patrick Walker (R4Risk), Population Data - Offsite Analysis, Attachment Offsite Population.xls, 9 January 2012. 15 May 2013 Page D.5 of 5

APPENDIX E LISTS OF HAZARDOUS SCENARIOS Confidential and Sensitive Document Exempt from disclosure under the Government Information (Public Access) Act 2009 (NSW) The complete Preliminary Hazard Analysis Report is provided to the NSW Department of Planning & Infrastructure ( DP&I ) by Caltex Refineries (NSW) Pty Ltd ( Caltex ) in confidence for use only within DP&I. It is submitted on the basis that there is an overriding public interest against disclosure pursuant to section 14(2) of the Government Information (Public Access) Act 2009 (NSW) (the Act ). The Report is exempt from disclosure under the Act on the grounds that it contains information associated with the storage of security sensitive petroleum finished product and information that is commercial-in-confidence. The information which is exempt from disclosure applies specifically to the following parts of the Report: Appendix E Lists of Hazardous Scenarios This report must not be copied or distributed outside DP&I without the express permission of Caltex. 15 May 2013 Page E.1 of 12

APPENDIX F QUALIFICATIONS AND EXPERIENCE OF THE HAZARD ANALYSIS TEAM 15 May 2013 Page F.1 of 3

F.1 R4RISK PROJECT TEAM An overview of the qualifications and experience of R4Risk s project team is provided within Table 1. Table 1: Project Team Summary Name Project Role Qualification and Relevant Experience Bachelor of Engineering (Chem) Hons., University of Melbourne Registered Professional Engineer (NPER -3); in the categories of Chemical (general) and Fire Safety Engineering Lachlan Dreher Project Manager Over 20 years experience in the risk management field. Technical Review Technical expert in QRA with extensive experience leading and conducting large QRA studies Was at the forefront in the development of in-house tools for the conduct of QRA (VRJ Risk Engineers / ModuSpec), including defining many of the algorithms used in these programs. Bachelor of Engineering (Chem, ) Hons., University of NSW Over eight years experience in a range of risk Dr. Patrick Walker Technical Analyst assessment techniques across a number of industries. Extensive experience in conducting consequence modeling and QRAs for the petrochemical, chemical and oil & gas industries. Bachelor of Engineering (Chemical and Biomolecular) Flora Chung Technical Analyst Hons., University of Melbourne. Analyst with experience in consequence modelling, fire safety studies and quantitative risk assessments. 15 May 2013 Page F.2 of 3

F.2 PROJECT TEAM EXPERIENCE R4Risk s project team has extensive experience in conducting a range of hazard and risk studies, including QRAs. These studies involved reviewing the corresponding processes to identify, understand and assess the risk associated with the significant hazards. A selection of these studies that involved the team members are listed in Table 2. Table 2: R4Risk Project Team Experience Client Project Legend International QRA for proposed Mount Isa Fertilizer Project (600 ktpa & 1200 ktpa) Confidential Peer review of QRA to identify modelling flaws resulting in overstated risk results. Caltex Australia QRA for Kurnell Refinery Coogee Chemicals QRA for Mt Isa Plant Expansion Incitec Pivot Peer review of QRA for proposed facility BHP QRA for proposed ammonium nitrate plant, including comparison of risks for alternate processing technologies and alternate site locations BHP QRA for proposed ammonia / urea fertilizer plant. BP Kwinana Refinery: QRA of facility Caltex Kurnell Refinery: QRA for new crude oil storage tank Caltex Kurnell Refinery: QRA to identify risk implications for occupied buildings at site. Marstel Terminals Coode Island bulk liquid storage terminal: QRA, including propylene oxide and acrylonitrile storage Mobil Mobil Altona Refinery: QRA of complete refinery Mobil Yarraville bulk liquid storage terminal: QRA of facility Mobil Yarraville bulk liquid storage terminal: Update QRA for changed tankage allocation Mobil Spotswood bulk liquid storage terminal: QRA of facility Mobil Colmslie Terminal: QRA of proposed LPG terminal Nufarm-Coogee Kwinana Chlor-Alkali Plant: QRA of proposed plant upgrade Nufarm-Coogee Kemerton Chlor-Alkali Plant: QRA of proposed plant upgrade Nufarm-Coogee Kwinana Chlor-Alkali Plant: QRA of proposed plant upgrade (modified design) Nufarm-Coogee Kemerton Chlor-Alkali Plant: QRA of proposed plant upgrade (modified design) Nufarm-Coogee Kwinana Chlor-Alkali Plant: QRA for plant expansion (low-pressure design) Nufarm Belvedere Agricultural Chemicals Plant (UK): QRA for chemicals manufacturing plant, including chlorine storage and handling Pasminco Hobart smelter: QRAs for acid plants Port of Brisbane Northshore Hamilton: QRA for development master plan Process Design & Barnawartha Biodiesel Plant: QRA of proposed facility Fabrication Queensland Nitrates Plant Moura ammonium nitrate plant: Preliminary QRA (including ammonia manufacture and storage) Queensland Nitrates Plant Moura ammonium nitrate plant: QRA for final design (including ammonia manufacture and storage) Queensland Nitrates Plant Moura ammonium nitrate plant: QRA Update for Major Hazard Facility compliance (including ammonia manufacture and storage) Queensland Nitrates Plant Moura ammonium nitrate plant: QRA for proposed plant expansion (including ammonia manufacture and storage) Queensland Nitrates Plant Moura ammonium nitrate plant: Risk review of ammonia storage options for proposed plant expansion (refrigerated storage vs pressurised storage) Queensland Nitrates Plant Quantitative & Qualitative Risk Analysis on the transportation of ammonia and ammonium nitrate Tiwest Kwinana Pigment Plant: QRA of facility 15 May 2013 Page F.3 of 3

Appendix C2 Kurnell Buncefield Review

Appendix C2 Kurnell Buncefield Review Topic Caltex Review Underlying Principles of Buncefield Investigation Recommendations Measures for controlling major incident risks must integrate: Integrity levels at major hazards sites in relation to containment of dangerous goods and process safety Mitigation against the effect of a major incident on off-site populations and buildings Preparedness for emergency response to limit the escalation of potential major incidents Land use planning and the control of societal risk; and The regulatory system for inspection and enforcement at major hazard industrial areas. The Caltex Kurnell site is currently a major hazard facility site and will remain so when converted to a fuels import and storage terminal. As such the facility is required to maintain a safety case which demonstrates that the control measures are fully integrated and adequate with respect to the management of major hazards risks and which specifically must address the possibility of events such as the Buncefield VCE. A review of the Buncefield incident and its recommendations was undertaken by Caltex during the preparation of the current safety case, which resulted in a number of additional control measures being adopted, particularly on gasoline tanks in the north east corner of the site. The current conversion project will extend these improvements to all other flammables storage and in significant part, to bulk combustible storage as well. These control improvements will be reflected in revisions of the safety case. Specific details of approaches taken by Caltex relating to each of the first three control areas listed on the left are provided in the table below. In addition, Caltex actively engages in land use planning management around its refineries and terminals ensuring that decisions made by local authorities relating to land use in potentially affected zones are properly informed by Caltex. Caltex also continues to work closely and proactively with planning authorities and state Workcover and Environment Protection authorities to ensure planning decisions take into account major hazards risks. For example, in Victoria Caltex is one of the first five companies to have worked collaboratively with Worksafe Victoria to produce published land-use planning guidelines for its terminals in that state. Finally, Caltex has consulted with NSW Workcover in relation to the ongoing maintenance and continuous improvement of the Kurnell Site Safety Case. Whilst the submitted safety case has not yet been formally assessed by NSW Workcover, Caltex is committed to ensuring that it continues to comply with all requirements throughout the transition of the site to a terminal only operation, that the controls adopted continue to eliminate risk where reasonably practicable, or where not reasonably practicable to eliminate the risk, reduce risk so far as is reasonably practicable. In the adoption and/or modification of controls, consideration has been and will continue to be made of the Buncefield Investigation recommendations and of all other major investigation recommendations pertinent to the facility. Caltex has committed to meeting at least quarterly with NSW Workcover to ensure these obligations continue to be met. Workcover NSW has made specific reference to the consideration of Buncefield recommendations in its oversight and consultation agenda. Topic Systematic Assessment of Safety Integrity levels Safety Integrity Control of safety systems for petroleum storage tanks; and; Incorporating the findings of SIL assessments into safety case reports BSTG Recommendation Published 24 July 2007 Before protective systems are installed there is a need to determine the appropriate level of integrity that such systems are expected to achieve. This report uses a layer of protection study (LOPA) to provide a more consistent approach to safety integrity level (SIL) assessment. For each risk assessment/sil determination study, operators must be able to justify each and every claim and data used in the risk assessment and ensure that appropriate management systems and procedures are implemented to support those claims. For COMAH top-tier sites this will form part of the demonstration required with the safety report. Of particular importance is the reliability and diversity of the independent layers of protection. To avoid common mode failures, extreme care should be taken when claiming high reliability and diversity, particularly for multiple human interventions. Minimum expected good practice The overall systems for tank filling control must be of high integrity, with sufficient independence to ensure timely and safe shutdown to prevent tank overflow. Site operators should meet the latest international standards, ie BS EN 61511:2004 Functional safety. Safety instrumented systems for the process industry sector 2. COMAH five-year periodic reviews of safety reports should incorporate a demonstration that: the overall systems for tank filling control are of high integrity, with sufficient independence to ensure timely and safe shutdown to prevent tank overflow; and the overall systems for tank filling control meet BS EN 61511:2004.2 Where the SIL assessment results in a change to the safety management system that could have significant repercussions with respect to the prevention of major accidents or the limitation of their consequences, operators of top-tier sites should review their safety Official MIIB Recommendation As published in final Report 2008 R1 Design & Operation The Competent Authority and operators of Buncefield-type sites should develop and agree a common methodology to determine safety integrity level (SIL) requirements for overfill prevention systems in line with the principles set out in Part 3 of BS EN 61511 (ref 3). This methodology should take account of: the existence of nearby sensitive resources or populations; the nature and intensity of depot operations; realistic reliability expectations for tank gauging systems; and the extent/rigour of operator monitoring. Application of the methodology should be clearly demonstrated in the COMAH safety report submitted to the Competent Authority for each applicable site. Existing safety reports will need to be reviewed to ensure this methodology is adopted. R4 Design & Operation The overfill prevention system (comprising means of level detection, logic/control equipment and independent means of flow control) should be engineered, operated and maintained to achieve and maintain an appropriate level of safety integrity in accordance with the requirements of the recognised industry standard for safety instrumented systems, Part 1 of BS EN 61511. Caltex Review 1. Caltex believes that these recommendations are adequately addressed by the NSW Work Health and Safety Regulation 2011 Chapter 9 and as such the requirement to demonstrate that tank overfill scenarios for all hazardous materials handled are properly identified, and that the associated control measures to prevent and mitigate consequences are appropriate and demonstrated as adequate in terms of availability, reliability, functionality and survivability are already mandatory requirements. 2. The current safety case for Kurnell Refinery addresses these requirements. Nevertheless, the adequacy demonstration for tank primary containment controls is again being progressively reviewed to ensure that any changes impacting tank filling operations are fully reviewed and that the facility risk assessment is adjusted to reflect agreed control measure improvements to be adopted under the proposed facility transition. The safety assessment methodology used in the safety case incorporates both QRA and LOPA, and specific SIL assessments are undertaken where instrumented systems form part of the control measure suite (as per AS61511). 3. Special QRA studies have specifically focussed on nearby population exposures, specifically the fuel storage tanks located closest to residential areas. The results of the QRA studies undertaken by Caltex, which have been recently reviewed and revised, are consistent with the Land Use Safety Study undertaken by the NSW Department of Planning (last revised in 2007). These studies found that full refinery operations at the site did not pose a significant risk to residential areas and overall risk fell within the approval guidelines. The current proposal to transition the site from a refinery to a terminal only will substantially lower the risk even further through elimination of a broad range of fire, explosion and toxic release potential incidents and through the adoption of additional layers of protection on both gasoline and combustible liquid storage tanks. Additional controls on gasoline storage tanks will include the installation of independent high- high level alarms and vapour detection systems in C2-1

Appendix C2 Kurnell Buncefield Review Topic Protecting against Primary LOC using high integrity systems BSTG Recommendation Published 24 July 2007 reports under the provisions of COMAH regulation 8(c).12. For the majority of sites it is not expected that a revised safety report is required to be submitted to the Competent Authority before the next five-year review. An appropriate demonstration of compliance should be included in safety reports submitted to the Competent Authority by the date of the next fiveyear periodic review of the safety report. Official MIIB Recommendation As published in final Report 2008 Independent levels of protection R3 Design & Operation Operators of Buncefield-type sites should protect against loss of containment of petrol and other highly flammable liquids by fitting a high integrity, automatic operating overfill prevention system (or a number of such systems, as appropriate) that is physically and electrically separate and independent from the tank gauging system. Such systems should meet the requirements of Part 1 of BS EN 61511 for the required safety integrity level, as determined by the agreed methodology. Where independent automatic overfill prevention systems are already provided, their efficacy and reliability should be reappraised in line with the principles of Part 1 of BS EN 61511 and for the required safety integrity level, as determined by the agreed methodology (see Recommendation 1). Caltex Review gasoline tank compounds as per subsequent MIIB and BSTG recommendations. 4. Caltex will continue to work with Workcover NSW to ensure the content of the safety case, the methodology for safety assessments and demonstration of the adequacy of control measures continues to be of a satisfactory standard. For the proposed Terminal; 1. All bulk flammables and combustible liquid storage tanks will have independent overfill protection systems designed and installed to Australian standards. 2. These systems will incorporate automatic shut-down capability. 3. These systems will be independent of the tank gauging system and will have the required assessed safety integrity level. 4. Design adequacy of ATG and IHLA systems has been reviewed and verified. 5. A deviation alarm between primary and independent levels systems is also being installed. 6. See also comments against R1 and R4 above. Management systems for maintenance of equipment and systems to ensure their continuing integrity in operation Inspection & maintenance systems should already be established. The MIIB s third progress report indicated that there was a problem with the tank level monitoring system at Buncefield. An examination of the records for Tank 912 from the automatic tank gauging (ATG) system suggest an anomaly in that the ATG system indicated that the level remained static while approximately 550 m 3 /hr of unleaded petrol was being delivered into Tank 912. Minimum expected good practice Overfill protection systems should be tested periodically to prove that they would operate safely when required. Proof testing should be end to end, incorporate elements of redundancy, and include the detector at the liquid interface and the valve closure element. The test period should be determined by calculation according to the historical failure rate for each component or the system and the probability of failure on demand required to achieve the specified SIL. Records of test results, including faults found and any repairs carried out, should be retained. Procedures for implementing changes to equipment and systems should ensure any such changes do not impair the effectiveness of equipment and systems in preventing loss of containment or in providing emergency response. R2 Design & Operation Operators of Buncefield-type sites should, as a priority, review and amend as necessary their management systems for maintenance of equipment and systems to ensure their continuing integrity in operation. This should include, but not be limited to reviews of the following: the arrangements and procedures for periodic proof testing of storage tank overfill prevention systems to minimise the likelihood of any failure that could result in loss of containment; any revisions identified pursuant to this review should be put into immediate effect; the procedures for implementing changes to equipment and systems to ensure any such changes do not impair the effectiveness of equipment and systems in preventing loss of containment or in providing emergency response. R5 Design & Operation All elements of an overfill prevention system should be proof tested in accordance with the validated arrangements and procedures sufficiently frequently to ensure the specified safety integrity level is maintained in practice in accordance with the requirements of Part 1 of BS EN 61511 1. Proof testing & inspection regimes for ATG and IHLA systems are adopted throughout Caltex terminals and refineries in accordance with documented procedures. 2. The tank level devices employed by Caltex are SAAB radar gauges and are not subject to the type of over-ride or failure mechanisms which occurred at Buncefield. Principles of safety in design have thus been employed. 3. All primary containment system elements are subject to a planned risk and reliability driven preventative maintenance program. Effective inspection and maintenance systems and procedures are already established. These procedures have been reviewed several times since the Buncefield incident. Any changes to inspection and maintenance regimes will be strictly managed under the Caltex Management of Change procedures and will be reflected in revisions of the safety case. 4. Critical system processes for ensuring equipment integrity are already clearly identified in the Safety Case and implemented. 5. Changes to any overfill protection element, to alarm set-points or to management system processes will continue to be rigorously assessed & managed by Caltex Management of Change processes. C2-2

Appendix C2 Kurnell Buncefield Review Topic Testing of overfill protection systems Tank overfill prevention: defining tank capacity Fire safe shut-off valves BSTG Recommendation Published 24 July 2007 Inspection and maintenance systems should already be established. Overfill protection alarms or shutdown systems using high level switches or other two-state detectors may be inactive for long periods and may develop unrevealed faults. Such faults cause the system to fail to danger when required to operate. Minimum expected good practice All elements of an overfill prevention system should be proof tested in accordance with the validated arrangements and procedures sufficiently frequently to ensure the specified safety integrity level is maintained in practice. The capacities of storage tanks should be clearly defined and appropriate safety margins put in place to prevent a release. To prevent overfill, tanks must have headspace margins to ensure that the intake will be closed off in time. High level alarms and operator or automatic actions must be adequately spaced to respond to a developing overfill situation. Minimum expected good practice Operating practices, staffing levels and systems must provide effective safety margins to prevent an overfilling release. Tank capacities and appropriate action levels should be set in accordance with this guidance. Tanks should not be intentionally filled beyond the normal fill level. Each pipe connected to a tank is a potential source of a major leak. In the event of an emergency, it is important to be able to safely isolate the contents of the tank. Isolation valves should be fire safe, i.e. capable of maintaining a leak-proof seal under anticipated fire exposure. Fire-safe shut-off valves must be fitted close to the tank on both inlet and outlet pipes. Valves must either conform to an appropriate standard (BS 6755-2 or BS EN ISO 10497), equivalent international standards or be of an intrinsically fire-safe design, i.e. have metal-to-metal seats (secondary metal seats on soft-seated valves are acceptable), not be constructed of cast iron and not be wafer bolted. Official MIIB Recommendation As published in final Report 2008 Caltex Review Refer R2 and R5 above 1. As per comments above. 2. The tank level devices employed by Caltex are SAAB radar gauges and are not subject to the particular type of over-ride or failure mechanism which occurred at Buncefield. The type of independent level detector to be installed is an analogue device rather than a switch. As such the sensor will always be in active measurement mode and subject to alarm if bad input or variation from the primary LT occurs. 3. Verification of the level indication reading will be achieved via automated cross-reference to the primary level gauging system as well as regular physical dips of the tanks. All alarming and interlock components will be tested as part of the site preventative maintenance, testing and inspection program. 4. Caltex will continue to review opportunities in maintenance regimes to ensure acceptable practice continues to be maintained for identified critical primary containment assets/components. 1. All bulk storage tanks have defined tank capacities & safe fill levels. 2. Caltex maintains current operating procedures clearly defining tank fill limitations and tank filling restrictions. 3. Caltex terminals have an established tank level alarm standard which requires tank alarm settings to be established on a tank by tank basis taking into account worst case filling rates and alarm response times for that particular tank. It also takes into account all staffing level variations and operating practices in establishing the adequacy of alarm setpoints. This standard ensures appropriate time is given for response to, and escalation of response to, an abnormal level condition before loss of containment can occur, and will be applied for all tanks (gasoline as well as others in converted terminal). 4. Any change to bulk storage tank fill limitations is analysed & managed by Caltex MOC processes. 1. Tanks valves will be upgraded to include fire proof coating as part of the conversion works 2. All valves being purchased for hydrocarbon service are to be fire safe and will be insulated. NOTE; Fire Safe refers to the valve being capable of maintaining its pressure containing ability during and after a certain period of fire as required by API 6D. C2-3

Appendix C2 Kurnell Buncefield Review Topic BSTG Recommendation Published 24 July 2007 Official MIIB Recommendation As published in final Report 2008 Caltex Review Remotely operated shut-off valves (ROSOVS) In an emergency, rapid isolation of vessels or process plant is one of the most effective means of preventing loss of containment, or limiting its size. A ROSOV is a valve designed, installed and maintained for the primary purpose of achieving rapid isolation of plant items containing hazardous substances in the event of a failure of the primary containment system (including, but not limited to, leaks from pipework, flanges, and pump seals). Valve closure can be initiated from a point remote from the valve itself. The valve should be capable of closing and maintaining tight shut off under foreseeable conditions following such a failure (which may include fire). Remotely operated shut-off valves (ROSOVs) for emergency isolation of hazardous substances: Guidance on good practice HSG244 provides guidance on how to assess the need to provide ROSOVs for emergency isolation. Minimum expected good practice ROSOVs for the emergency isolation of hazardous substances should be fitted to the outlet pipe tanks in scope where an assessment under HSG244 indicates that such valves should be fitted. ROSOVs for the emergency isolation of hazardous substances should fail safe. Operators of existing sites should review their risk assessments to ensure that an effective assessment has been undertaken following the key stages in HSG244. 1. All tank valves are able to be remotely isolated, have been selected to be Fire Safe and will be fire proofed as discussed above. 2. The safety case detail will be reviewed against HGS244 to verify whether any additional requirements apply. Safe management of fuel transfer The initial report of the Buncefield Major Incident Investigation Board identified an issue with regard to safety arrangements, including communications, for fuel transfer. No existing authoritative guidance was found that adequately described this and so a set of principles for safe management of fuel transfer, which includes the adoption of principles for consignment transfer agreements has been developed. Minimum expected good practice Companies involved in the transfer of fuel by pipeline should: - Adopt the principles for safe management of fuel transfer - Where one party controls the supply, and another controls the receiving tanks, develop consignment transfer agreements consistent with these principles. - Ensure that suitable job factors are provided to facilitate safe fuel transfer Companies involved in inter-business transfer of fuel by pipeline should have agreed on the nomenclature to be used for their product types For ship-to-shore transfers, carry out a terminal specific review to ensure compliance with the International Shipping Guide for Oil Tankers and Terminals. Receiving sites to develop procedures for transfer planning and review them with their senders and appropriate intermediates. Ensure that written procedures are in place, and consistent with current good practice, for safety-critical operating activities in the transfer and storage of fuel. R6 Design & Operation The sector should put in place arrangement to ensure the receiving site (as opposed to the transmitting location) has ultimate control over the tank filling R7 Design & Operation The sector should undertake a review of the adequacy of existing safety arrangements, including communications, employed by those responsible for pipeline transfers of fuel R9 Design & Operation Operators of terminals should implement systems to ensure systematic maintenance of records pertaining to product movement and operation of the overfill prevention systems and any associated systems R10 Design & Operation The sector and regulators should agree on a system of lead and lag performance indicators for process safety performance 1. The proposed Kurnell Import terminal differs fundamentally from the Buncefield fuel terminal in that it will be a ship import terminal. There is no routine delivery of product to Kurnell via pipeline under the proposed new terminal arrangements although the existing D-line may be used for minor product movements between Caltex Kurnell and Caltex Banksmeadow terminal in the short term (as per current operations). In the latter case Kurnell will retain control of the filling operations as the receiving site. 2. Caltex adopts international standards for ship to shore transfer operations and these are rigorously applied. These arrangements include robust controls for communication protocols, transfer monitoring and surveillance, and for transfer cessation. All transfers are commenced only after ullage confirmation of receiving tanks. 3. Records for all product movements are systematically maintained by Caltex. 4. The control system for products movement operations will record all events associated with overfill protection controls. This includes full monitoring of dead tanks as well as tanks involved in active transfers. Operating systems incorporate confirmation of safe ullage volume and preset transfer alarms. 5. Existing safety arrangements for both ship receipt operations and internal pipeline movements have been systematically reviewed under the site safety case and include assessment of their adequacy (including communications controls). Further reviews and where necessary, revision will occur as part of ongoing management of change and routine continuous improvement activities. 6. Caltex has a defined process for operational excellence performance monitoring and governance which includes a full suite of targeted lead and lag performance indicators appropriate to monitoring the practical effectiveness of all control measures. C2-4

Appendix C2 Kurnell Buncefield Review Topic BSTG Recommendation Published 24 July 2007 Official MIIB Recommendation As published in final Report 2008 Overfill Protection System design R8 Design & Operation The sector, including its supply chain of equipment manufacturers and suppliers, should review and report without delay on the scope to develop improved components and systems, including but not limited to the following: alternative means of ultimate high level detection systems that do not rely on components internal to the tank with the emphasis on ease of inspection, testing and maintenance. increased dependability of tank gauging systems should be explored through improved validation of measurements & trends, allowing warning of faults and using modern sensors with increased diagnostic capability. systems to control and log override actions. Engineering against escalation against loss of primary containment R11 Design & Operation Operators of Buncefield-type sites should review the classification of places within COMAH sites where explosive atmospheres may occur and their selection of equipment and protective systems (as required by the Dangerous Substances and Explosive Atmospheres Regulations 2002(ref 6)). This review should take into account the likelihood of undetected loss of containment and the possible extent of an explosive atmosphere following such an undetected loss of containment. Operators in the wider fuel and chemicals industries should also consider such a review, to take account of events at Buncefield R12 Design & Operation Following on from Recommendation 11, operators of Buncefield-type sites should evaluate the siting and/or suitable protection of emergency response facilities such as fire fighting pumps, lagoons or manual emergency switches. Caltex Review 1. Caltex currently relies on its testing, inspection and maintenance systems to demonstrate reliability of its ultimate high level alarm and tank gauging systems. 2. The Kurnell terminal bulk storage tank high levels systems will be monitored via Vias-OM. The system provides superior diagnostic capabilities to those available at the time of the Buncefield Incident including data comparison alarms between independent systems, and smart monitoring of tank inventories. 3. Caltex continues to explore emerging technologies with equipment suppliers for higher reliability and smarter system components and will progressively adopt such systems as they become available where appropriate and reasonably practicable to do so. 4. Caltex rejects the ante-tank design proposal described in Annex 4 of the recommendations report on the basis that it has the potential to introduce more hazards, reduce effective tank capacity, eliminate safe response time windows and thereby increase risk. 1. Hazardous Area classifications are regularly reviewed for all Caltex sites to ensure they remain appropriate to the types, quantities and activities associated with the handling of hazardous materials. Classification of hazardous areas and selection of equipment and protective systems is conducted in accordance with Australian Standards HB13-2007 and AS2381. 2. The current NSW regulation relating to major hazard facilities requires a comprehensive and systematic safety assessment relating to every identified major incident scenario. Part of this safety assessment is analysis of the nature of the incident and hazards concerned, ultimately leading to adoption of control measures which reduce risk so far as is reasonable practicable. The analysis includes review of potential sources of ignition in the event of a loss of containment or other formation of flammable atmospheres and the verification of adequacy of the controls for both prevention of loss of containment event as well as for prevention of ignition. The safety assessment forms part of the current safety case. All future revisions of the safety assessment will continue to analyse and assess ignition hazards. 3. Caltex will continue with the current risk based approach and to identify and develop action plans relating to the undetected loss of containment and generation of explosive environments. The ongoing review of potential scenarios is considered part of the site s continuous improvement process for its Safety Case. 1. The current NSW regulations relating to major hazard facilities require a comprehensive and systematic safety assessment to be conducted relating to every identified major incident scenario. Part of this safety assessment is to analyse the nature of the incident and hazards concerned, and to adopt control measures which reduce risk so far as is reasonable practicable. This analysis includes review of all applicable consequence scenarios in the event of a loss of containment or fire events and the adequacy of siting for critical emergency response and shut-down controls. A key part of the study is consideration of the practicality of access to these key controls as well as survivability in the event of a major fire or explosion. The required revision of the Safety Assessment for the converted terminal will include review of these matters. This includes a Fire Safety Study for the Kurnell Terminal as per HIPAP2. C2-5

Appendix C2 Kurnell Buncefield Review Topic BSTG Recommendation Published 24 July 2007 Official MIIB Recommendation As published in final Report 2008 Caltex Review R13 Design & Operation Operators of Buncefield-type sites should employ measures to detect hazardous conditions arising from loss of primary containment, including the presence of high levels of flammable vapours in secondary containment. Operators should without delay undertake an evaluation to identify suitable and appropriate measures. This evaluation should include, but not be limited to, consideration of the following: installing flammable gas detection in bunds containing vessels or tanks into which large quantities of highly flammable liquids or vapour may be released; the relationship between the gas detection system and the overfill prevention system. Detecting high levels of vapour in secondary containment is an early indication of loss of containment and so should initiate action, for example through the overfill prevention system, to limit the extent of any further loss; installing CCTV equipment to assist operators with early detection of abnormal conditions. Operators cannot routinely monitor large numbers of passive screens, but equipment is available that detects and responds to changes in conditions and alerts operators to these changes. 1. Reviews as per recommendation R13 have already been undertaken. Additional hydrocarbon vapour detectors have been installed in several existing tanks as per 2007 LUSS Recommendations, and will be installed in suitable locations within flammable bunds as part of the conversion upgrade works. 2. The detection of hydrocarbon vapours at or above 10% of the lower explosive limit will raise a clearly visible and audible alarm. 3. A number of CCTV units will be situated around the site (extent yet to be determined following full site security review currently being undertaken). Where cameras are being installed for increased security surveillance, the option of installing in those units additional IR detection with alarming capability is being considered. 4. The decision for leak surveillance equipment beyond the measures currently employed or detailed above will be made on a tank by tank basis taking into account all required factors when determining what is reasonably practicable. Revision to the risk assessments within the safety case will reflect these considerations. NOTE: this same approach is being applied for other locations; e.g. pumping stations. R14 Design & Operation Operators of new Buncefield-type sites or those making major modifications to existing sites (such as installing a new storage tank) should introduce further measures including, but not limited to, preventing the formation of flammable vapour in the event of tank overflow. Consideration should be given to modifications of tank top design and to the safe re-routing of overflowing liquids. 1. The Kurnell conversion project does not include installation of any new bulk storage tanks. 2. All tanks are designed, constructed and maintained to industry standards API 650 and API 653. 3. Caltex is closely monitoring further research into tank top design and others factors. It has most recently reviewed RR937 prepared by the UK Health and Safety Laboratory for the UK Health and Safety Executive in 2012. Any definitive learnings from emerging research will be taken into consideration in current and subsequent safety assessment reviews. R15 Design & Operation The sector should begin to develop guidance without delay to incorporate the latest knowledge on preventing loss of primary containment and on inhibiting escalation if loss occurs. This is likely to require the sector to collaborate with the professional institutions and trade associations. 1. Where there is opportunity to participate in industry sector collaboration on safety standards Caltex actively supports and participates in such initiatives. 2. Caltex currently sits on both NSW and Victorian MHF Advisory committees pertaining to the management and regulatory oversight of registered and/or licenced major hazard facilities. R16 Design & Operation Operators of existing sites, if their risk assessments show it is not practicable to introduce measures to the same extent as for new ones, should introduce measures as close to those recommended by Recommendation 14 as is reasonably practicable. The outcomes of the assessment should be incorporated into the safety report submitted to the Competent Authority. 1. Refer to comments for previously listed recommendations where a range of additional control measures which have been and/or will be adopted to prevent and/or reduce vapour cloud formation have been discussed. C2-6

Appendix C2 Kurnell Buncefield Review Topic Engineering against loss of secondary and tertiary containment Firewater management and control measures BSTG Recommendation Published 24 July 2007 Bund wall and floor construction and penetration joints should be leaktight. Surfaces should be free from any cracks, discontinuities and joint failures that may allow relatively unhindered liquid trans-boundary migration. As a priority, existing bunds should be checked and any damage or disrepair, which may render the structure less than leak-tight, should be remedied. Bund walls should be leak-tight. As a priority, existing bund walls should be checked and any damage or disrepair, which may render the wall less than leak-tight, should be remedied. Joints in concrete or masonry bunds walls should be capable of resisting fire. Existing bunds should be modified to meet this requirement. In addition to repairing any defects in bund joints, steel plates should be fitted across the inner surface of bund joints, and/or fire-resistant sealants should be used to replace or augment non-fire-resistant materials. Bund capacity at existing installations should be a minimum of 110% of the largest contained tank. Should already be in place as good practice. Site-specific planning of firewater management and control measures should be undertaken with active participation of the local Fire and Rescue Service. Official MIIB Recommendation As published in final Report 2008 R17 Engineering against loss of secondary and tertiary containment The Competent Authority and the sector should jointly review existing standards for secondary and tertiary containment with a view to the Competent Authority producing revised guidance by the end of 2007. The review should include, but not be limited to the following: developing a minimum level of performance specification of secondary containment (typically this will be bunding); developing suitable means for assessing risk so as to prioritise the programme of engineering work in response to the new specification; formally specifying standards to be achieved so that they may be insisted upon in the event of lack of progress with improvements; improving firewater management and the installed capability to transfer contaminated liquids to a place where they present no environmental risk in the event of loss of secondary containment and fires; providing greater assurance of tertiary containment measures to prevent escape of liquids from site and threatening a major accident to the environment. R18 Engineering against loss of secondary and tertiary containment Revised standards should be applied in full to new build sites and to new partial installations. On existing sites, it may not be practicable to fully upgrade bunding and site drainage. Where this is so operators should develop and agree with the Competent Authority risk-based plans for phased upgrading as close to new plant standards as is reasonably practicable. Caltex Review 1. As per R18, Caltex applies risk based plans agreed in consultation with NSW Workcover and Department of Planning for bunding and site drainage upgrades. 2. Caltex adopts AS1940 as its common standard for flammable and combustible liquid compounds. Where new tank compounds are to be constructed or existing compounds are to be substantially altered, full review of all relevant Buncefield recommendations are taken into consideration in design of those systems. 3. Bund upgrade works are included in the conversion project scope of works as detailed elsewhere in this submission but these do not entail significant alteration to current bund design. Bunds will meet key requirements as listed in the BSTG recommendations. All bund walls are sealed either with bitumen or are concrete encased 4. Caltex has reviewed current HSE UK guidance on secondary and tertiary containment and refers to the following posted note indicating that the revised guidance is not yet available: While the technical content of this guidance remains substantially correct, some of the legislation referred to has been superseded. The Highly Flammable Liquids and Liquefied Petroleum Gases Regulations 1972 have been replaced by the Dangerous Substances and Explosive Atmospheres Regulations 2002 (DSEAR). Legislation.. and revised guidance is due to be published in 2012. Caltex continues to monitor emerging industry guidance and practices relating to engineering design and construction standards. Pertinent improvements are adopted where reasonably practicable to do so. 5. Caltex is closely monitoring current research into bund and drainage design and others factors. It has most recently reviewed RR937 prepared by the UK Health and Safety Laboratory for the UK Health and Safety Executive in 2012. 6. Caltex revises the matters listed in R17 as a matter of course when revising its Safety Cases and their associated demonstration of adequacy of control measures. 7. Caltex secondary and tertiary containment measures are subject to preventative inspection and maintenance regimes as for any other control measure to ensure that any compromise to the leak tightness of containment is systematically identified and remedied. 1. The adequacy of emergency resources and procedures is already required to be reviewed in consultation with NSW Fire and Rescue under the major hazard facilities regulations as well as via planning approval requirements. 2. A Fire Safety Study, as per HIPAP2 guidelines, has been prepared for the proposed Terminal changes and is the subject of consultation with Fire & Rescue NSW. 3. Reviews of major incident and pre-incident plans specifically address practical firewater requirements in responding to major fire events as well as firewater management issues. 4. Caltex has recently expended capital to improve the practicability of fire response. This has included improved foam delivery systems and higher capacity foam monitors for combat of tank top & bund spills/fires. C2-7

Appendix C2 Kurnell Buncefield Review Topic BSTG Recommendation Published 24 July 2007 Official MIIB Recommendation As published in final Report 2008 Caltex Review High reliability organisations Roles responsibilities & competence Operators should ensure that they have: clearly identified the roles and responsibilities of all those involved in managing, performing or verifying work in the management of major hazards, including contractors; and implemented a competence management system, linked to major accident risk assessment, to ensure that anyone whose work impacts on the control of major accident hazards is competent to do so. R19 Design & Operation The sector should work with the Competent Authority to prepare guidance and/or standards on how to achieve a high reliability industry through placing emphasis on the assurance of human and organisational factors in design, operation, maintenance, and testing. Of particular importance are: understanding and defining the role and responsibilities of the control room operators (including in automated systems) in ensuring safe transfer processes; providing suitable information and system interfaces for front line staff to enable them to reliably detect, diagnose and respond to potential incidents; training, experience and competence assurance of staff for safety critical and environmental protection activities; defining appropriate workload, staffing levels and working conditions for front line personnel; ensuring robust communications management within and between sites and contractors and with operators of distribution systems and transmitting sites (such as refineries); prequalification auditing and operational monitoring of contractors capabilities to supply, support and maintain high integrity equipment; providing effective standardised procedures for key activities in maintenance, testing, and operations; clarifying arrangements for monitoring and supervision of control room staff; and effectively managing changes that impact on people, processes and equipment. R20 Design & Operation Terminal operators should ensure the resulting guidance is fully implemented. R21 Design & Operation The sector should put in place arrangements to ensure that good practice in these areas, incorporating experience from other higher hazard sectors, is shared openly between organisations. R22 Design & Operation The regulator should ensure that MHF Safety Cases contain demonstration that good practice in human and organisational design, operation, maintenance and testing is implemented as rigorously as for engineering systems. 1. Schedule 17 Part 2 of the NSW Work Health and Legislation addresses these recommendations and as such Caltex is required to comply as an operator of a major hazard facility. Caltex s obligations with regard to the legislation are met through the design and implementation of its Operational Excellence Management System which has specific elements which address human factor hazards and competence management specifically. 2. Kurnell refinery has in recent years completed several detailed organisational and human factor effectiveness studies. This has included detailed studies for console operators, field operators and frontline supervisors for normal, abnormal and emergency operations. This data is being used to manage safe operations during the transition period and will be used to assist in organisational design for the new terminal arrangements. 3. Caltex is using its management of change process to ensure all the matters raised in the recommendation are taken into account where any changes to personnel, organisation or personnel /plant interfaces are proposed. 4. The OEMS also has specific elements which cover Contractor Safety Management including pre-qualification, and operational monitoring of contractors capabilities to supply, support and maintain high integrity equipment. 5. Caltex has long recognised the importance of establishing high reliability in its human resource. Programs such as IIF have been an example of industry leading initiatives in this area. 6. Where possible, Caltex will participate in cooperative activities initiated and coordinated by the regulator to develop standards and guidance relating to establishment and development of high reliability organisations. 7. Adoption of any resultant standards will be managed through the continuous improvement activities under the OEMS. C2-8

Appendix C2 Kurnell Buncefield Review Topic Staffing and shift work arrangements Shift handover Organisational change and management of contractors BSTG Recommendation Published 24 July 2007 Operators should: Ensure they can demonstrate that staffing arrangements are adequate to detect, diagnose and recover any reasonably foreseeable hazardous scenario in relation to fuel transfer and storage; and ensure that shift work is adequately managed to control risks arising from fatigue. Staffing and shift work arrangements are critical to the prevention, control and mitigation of major accident hazards. Site operators should be able to demonstrate that staffing arrangements ensure there are sufficient alert, competent personnel to deal with both normal operation and hazardous scenarios arising from abnormal events in fuel transfer and storage. Some high hazard organisations have set staffing levels based on steadystate operations. HSE Contract Research Report Assessing the safety of staffing arrangements for process operations in the chemical and allied industries CRR 348/2001, was commissioned to provide a method to demonstrate that staffing arrangements are adequate for hazardous scenarios as well as normal operations. Operators should set and implement a standard for effective and safe communications at shift and crew changes handover in relation to fuel transfer and storage. For top tier COMAH sites a summary of the standard should be included in the next revision of the safety report. Site operating companies should ensure that: there is a suitable policy and procedure for managing organisational changes, and for retention of corporate memory; the policy and procedure ensures that the company retains adequate technical competence and intelligent customer capability when work impacting on the control of major accident hazards is outsourced; suitable arrangements are in place for managing and monitoring contractor activities. Official MIIB Recommendation As published in final Report 2008 Caltex Review Part of R19 as detailed above 1. Current requirements for a major hazard facility operator already require consideration and management of these factors. 2. Kurnell refinery has in recent years completed several detailed organisational & human factor effectiveness studies. This has included detailed studies for console operators, field operators and frontline supervisors utilising guidance contained in: a. Organisational change and major accident hazards; Chemical Information Sheet No. CHIS7. UK Health & Safety Executive 06/2003. b. Energy Institute, Safe Staffing Arrangements User Guide for CRR348/2001 Methodology, Institute of Petroleum and HSE, 2004. This data is being used to manage safe operations during the transition period and will be used to assist in organisational design for the new terminal arrangements. 3. All impacts resulting from any change to staffing /personnel arrangements will be specifically addressed by the management of change processes focussed around organisation and training and competency. Demonstration of the adequacy of the controls adopted with regard to human factor matters will be articulated in revisions of the site safety case. 1. As per comments above. Current requirements for a major hazard facility operator already require consideration and management of these factors. The Caltex Operational excellence management system and site specific operating procedures address these factors. 1. Procedures are already established under the OEMS for Management of Change which includes organisational change, as well as for Contractor Safety Management. 2. Caltex has in recent years invested in process development & delivery of several detailed organisational & human factor effectiveness studies. These have been undertaken to assess proposed organisational changes. 3. Retention of corporate memory remains a challenge for all of industry. Caltex is no exception and relies heavily on its Safety Case and safety management system elements to record, retain and transfer knowledge in relation to major hazards risk. This remains a particular focus of the management of change process for the Kurnell conversion project. 4. As a terminal, Caltex will retain management control of all tasks undertaken on the site by contractors. C2-9

Appendix C2 Kurnell Buncefield Review Topic BSTG Recommendation Published 24 July 2007 Official MIIB Recommendation As published in final Report 2008 Caltex Review Performance evaluation and process safety performance measurement Site operators should: Ensure they have a suitable active monitoring programme in place for those systems and procedures that are key to the control of fuel transfer and storage; and Develop an integrated set of leading and lagging performance indicators for effective monitoring of process safety performance 1. Active performance monitoring of all controls critical to the prevention and/or mitigation of major hazards risks is currently in place for all Caltex terminals and refineries. In transition to an import terminal the site will maintain a complete performance monitoring regime. Any changes to controls, performance indicators for those controls, or to the methods or frequency of performance monitoring will be strictly managed under the management of change process and recorded in revisions of the safety case. 2. A full suite of leading and lagging performance indicators linked to safety management systems performance is an integral part of OEMS operation. Reporting of performance against these indicators is escalated to the Caltex board as a regular element of the reporting mechanism. 3. This is already a central requirement of the MHF regime which will be specifically verified and overseen by NSW Workcover. 1. These recommendations are addressed to the petroleum sector more broadly. There are however some elements which can be satisfied by Caltex specifically, in relation to the Kurnell site. 2. Caltex refining and terminals use the same corporate system for internal collation and sharing of incident data across the broader company; the Loss Prevention System. This is a well-established and implemented system which is set up to appropriately address process safety incidents as well as near-losses. The system also incorporates a program of companywide alerts and an extensive investigation, analysis and reporting program. All Caltex employees participate in the LPS activities to ensure lessons are learned from incidents and good practices are shared. 3. Thorough investigations and database records meeting the requirements of recommendation 24 are already employed through LPS. 4. Caltex is a leading participant of industry sectors forums such as Safe Load Pass which share information on sector hazards, incidents and control improvements. Delivering high performance through Culture & Leadership R23 Design & Operation The sector should set up arrangements to collate incident data on high potential incidents including overfilling, equipment failure, spills and alarm system defects, evaluate trends, and communicate information on risks, their related solutions and control measures to the industry. R24 Design & Operation The arrangements set up to meet Recommendation 23 should include, but not be limited to, the following: thorough investigation of root causes of failures and malfunctions of safety and environmental protection critical elements during testing or maintenance, or in service; developing incident databases that can be shared across the entire sector, subject to data protection and other legal requirements. Examples exist of effective voluntary systems that could provide suitable models; collaboration between the workforce and its representatives, dutyholders and regulators to ensure lessons are learned from incidents, and good practices are shared. R25 Design & Operation In particular, the sector should draw together current knowledge of major hazard events, failure histories of safety and environmental protection critical elements, and developments in new knowledge and innovation to continuously improve the control of risks. This should take advantage of the experience of other high hazard sectors such as chemical processing, offshore oil and gas operations, nuclear processing and railways. C2-10

Appendix C2 Kurnell Buncefield Review Topic BSTG Recommendation Published 24 July 2007 Official MIIB Recommendation As published in final Report 2008 Caltex Review Emergency Arrangements Principles for Emergency Arrangements All sites in scope should prepare in writing a suitable on-site emergency plan as required by the COMAH Regulations. For lower-tier COMAH sites the plan should be prepared as part of the MAPP. The emergency plans should consider the response to and mitigation of a multiple tank fire following an explosion. The plan should cover the on-site consequences of such an event and the assistance available in the form of off-site mitigatory actions. The incident-specific emergency response plans should consider fire management requirements in response to, and mitigation of, a multiple tank fire. The plan should cover the on-site consequences of such an event and the assistance available in the form of off-site mitigatory actions. Any plan deemed necessary to deal with such an event must be capable of operating effectively even in the event of a preceding explosion. R1 Emergency preparedness, response & recovery Operators of Buncefield-type sites should review their emergency arrangements to ensure they provide for all reasonably foreseeable emergency scenarios arising out of credible major hazard incidents, including vapour cloud explosions and severe multi-tank fires that, before Buncefield, were not considered realistically credible. The Competent Authority should ensure that this is done. 1. The matter referred to in R1 is already a requirement of the NSW Work Health and Safety Regulation and therefore required to be demonstrated in the location s safety case. BSTG recommendations 283-292 are also covered under these provisions. 2. Ongoing revisions of the site s Safety Case will continue to review global Major Incidents to ensure that all Major Incident potentials at the facilities continue to be comprehensively identified, assessed and controlled. 3. Pre-incident plans for all identified major incident scenarios are being reviewed and updated as part of the conversion project. On-site emergency plan A template for an on-site emergency plan can be found at www.hse.gov.uk/comah/buncefield/final.htm. It is envisaged that sites will complete this template and that it will then act as a high-level document providing an overview of the site s arrangements. Underpinning this document will be a series of detailed plans relating to specific incidents. R2 Emergency preparedness, response & recovery The Competent Authority should review the existing COMAH guidance on preparing on-site emergency plans. This guidance needs to reflect the HSE s Hazardous Installations Directorate (HID) 7 Chemical Industries Division inspection manual used by inspectors to assess the quality of the on-site plan in meeting the COMAH Regulations. In particular, reference should be made to the need to consult with health advisors and emergency responders. R3 Emergency preparedness, response & recovery For Buncefield-type sites, operators should review their onsite emergency plans to reflect the revised guidance on preparing on-site emergency plans as per Recommendation 2. The Competent Authority will need to check that this is done. 1. Caltex will continue to work in conjunction with Workcover NSW, the NSW Department of Planning and Infrastructure and the emergency services (in particular NSW Fire and Rescue) in review and revision of its emergency arrangements for the Kurnell site and specifically with respect to the terminal conversion plan. 2. Caltex will continue taking into account published guidelines and standards issued from time to time by the various state and federal regulators. (e.g. HIPAP2) 3. Any revision to this guidance will be reviewed and existing safety cases including emergency arrangements will be reviewed and revised as necessary in response to the revised Guidelines, as per current arrangements. C2-11

Appendix C2 Kurnell Buncefield Review Topic BSTG Recommendation Published 24 July 2007 Official MIIB Recommendation As published in final Report 2008 Caltex Review Firefighting planning and preparation This topic comprises of two elements; firstly, the actions that should be put in place before an event occurs and secondly, actions that should be carried out once an event has occurred. These arrangements should be agreed by all parties involved, including off-site responders. Planning aids the firefighting operations immensely by determining what is needed to extinguish the fire or manage a controlled burn, and how to deliver the required resources and manage firewater to prevent environmental impact. Scenario-based incident-specific emergency response plans can identify incident control resources required for accidental release, spillages and fire and emergency response. They can also provide guidance on control and deployment of the necessary resources and importantly, can be used as a tool to exercise against, thus closing the loop from preparation to planned and exercised response. Such deliberations should form part of the environmental and safety risk assessment carried out by the operator when producing the on-site emergency plan. This should be in consultation with the environment agencies, the local authorities, the emergency services (particularly the Fire and Rescue Service) and other stakeholders. R5 Emergency preparedness, response & recovery For Buncefield-type sites, operators should evaluate the siting and/or suitable protection of emergency response facilities such as the emergency control centre, firefighting pumps, lagoons or manual switches, updating the safety report as appropriate and taking the necessary remedial actions. R6 Emergency preparedness, response & recovery Operators should identify vulnerable critical emergency response resources and put in place contingency arrangements either on or off site in the event of failure at any time of the year and make appropriate amendments to the on-site emergency plan. This should include identifying and establishing an alternative emergency control centre with a duplicate set of plans and technical information. R7 Emergency preparedness, response & recovery For COMAH sites, if the operator relies on an off-site Fire and Rescue Service to respond, the operator s plan should clearly demonstrate that there are adequate arrangements in place between the operator and the service provider. The Competent Authority will need to check that this is done. 1. Requirements from both recommendation sources are implicitly covered under existing NSW legislation for major hazard facilities: The operator of a determined major hazard facility must prepare an emergency plan for the major hazard facility that: (a) addresses all health and safety consequences of a major incident occurring, and (b) includes all matters specified in Schedule 16, and (c) provides for testing of emergency procedures, including the frequency of testing. In preparing an emergency plan, the operator must consult with: (a) the following bodies: (i) Fire and Rescue NSW, and (ii) if the facility is within a rural fire district within the meaning of the Rural Fires Act 1997 the NSW Rural Fire Service, and (b) in relation to the off-site health and safety consequences of a major incident occurring the local authority. The operator must ensure that the emergency plan addresses any recommendation made by the emergency service organisations consulted under subclause (2) in relation to: (a) the testing of the emergency plan, including the manner in which it will be tested, the frequency of testing and whether or not the emergency service organisations will participate in the testing, and (b) what incidents or events at the major hazard facility should be notified to the emergency service organisations. The operator must have regard to any other recommendation or advice given by a person consulted under subclause (2). 2. Current site fire safety studies and emergency plan reviews address these recommendations. Pre-incident plans for all identified major incident scenarios are regularly reviewed and updated, and will be revised to reflect any changes made to plant, emergency controls and the emergency organisation as a result of the conversion to a terminal. 3. Sites will continue, in consultation with NSW Fire and Rescue and other nominated authorities, to identify and implement further practicable improvements. 4. As for any other control measure, the emergency planning arrangements and infrastructure are included in the Safety Case and require suitable demonstration of adequacy. Training & Competency for Emergency Response Trained, knowledgeable and competent personnel must be involved in the exercise of the firefighting plan and in the testing of the on-site plan. They must fulfil the tasks they will be expected to fulfil during an incident. R4 Emergency preparedness, response & recovery Operators should review and where necessary revise their on-site emergency arrangements to ensure that relevant staff are trained and competent to execute the plan and should ensure that there are enough trained staff available at all times to perform all the actions required by the on-site emergency plan. 1. As for comments against R4-R7 above, this recommendation is already covered by the Work Health and Safety Regulation. 2. Training and competency in the current and amended emergency plan will be maintained throughout the site transition to an operating import terminal. C2-12

Appendix C2 Kurnell Buncefield Review Topic BSTG Recommendation Published 24 July 2007 Official MIIB Recommendation As published in final Report 2008 Caltex Review Preparedness Mutual Aid (National Framework) R12 Emergency preparedness, response & recovery Communities and Local Government should complete and, where necessary, initiate an assessment of the need for national-level arrangements to provide, fund and maintain, emergency response equipment (such as high volume pumps, firefighting foam and specialist pollution containment equipment). The review could also consider criteria for allocation and use of this equipment across the UK. R23 Emergency preparedness, response & recovery The operators of industrial sites where there are risks of large explosions and/or large complicated fires should put in place, in consultation with fire and rescue services at national level, a national industry fire service mutual aid arrangement. The aim should be to enable industry equipment, together with operators of it as appropriate, to be available for fighting major industrial fires. Industry should call on the relevant trade associations and working group 6 of the Buncefield Standards Task Group to assist it, with support from CCS. The COMAH Competent Authority should see that this is done. 1. Whilst these two specific recommendations are really aimed at industry sectors and local, state and national government initiatives, Caltex recognises its role as a responsible member of the Kurnell community and as such actively supports mutual aid and community emergency response arrangements. 2. The revision of the Kurnell Emergency Plan to reflect operation of the site as an import terminal will specifically revise mutual aid resourcing and agreements. Warning and informing the public R8 Emergency preparedness, response & recovery COMAH site operators should review their arrangements to communicate with residents, local businesses and the wider community, in particular to ensure the frequency of communications meets local needs and to cover arrangements to provide for dealing with local community complaints. They should agree the frequency and form of communications with local authorities and responders, making provision where appropriate for joint communications with those bodies. R9 Emergency preparedness, response & recovery The Competent Authority should review the COMAH guidance to assist operators in complying with Recommendation 8 and should work with the Cabinet Office to integrate the COMAH guidance and the CCA Communicating with the public(ref 9) guidance, so that communications regarding COMAH sites are developed jointly by the site operator and the local emergency responders. 1. Caltex Kurnell is an integral part of the community in which it operates and as such recognises the importance of appropriate community information and communication. 2. Caltex will continue to place high priority on ensuring the intended outcome from R8 continues to be achieved. 3. Caltex has the following established communication channels in the event of an emergency: a. Appointed members of the Caltex management team in the Emergency Operations Centre provide information updates to the media, employees and contractors. b. Appointed members of the Caltex management team monitor & respond to community inquiries via 1800 response hotline. c. Appointed members of the Caltex management team in the Emergency Operations Centre provide information to NSW Police who are responsible for communicating and coordinating community action (e.g. evacuation) should this be required. d. Caltex provides subsequent feedback to community stakeholders following an Emergency. This is typically communicated via routine feedback at community meetings. C2-13