Kinder Morgan Canada

Transcription

1 Kinder Morgan Canada Trans Mountain Pipeline ULC Trans Mountain Expansion Project Burnaby Terminal Portion Final Report October 1 st, 2013 Prepared By: A Division of Human Factors Impact Ltd. Doug McCutcheon, P. Eng PO Box 254 Canal Flats, BC, Canada, V0B 1B0 Phone: Fax: doug.mccutcheon@ualberta.ca

2 TABLE OF CONTENTS PAGE EXECUTIVE SUMMARY 3 GENERAL REPORT 5 HAZARD IDENTIFICATION ANALYSIS 7 CONSEQUENCE ANALYSIS 14 PROBABILITY ANALYSIS and HUMAN RELIABILITY ANALYSIS 26 RISK ANALYSIS 30 CONCLUSIONS 31 APPENDICIES: 1. Risk Management Process MIACC Acceptable Level of Risk Criteria Maps of the Area References 53 LIST OF TABLES Table 1: Measurable Consequences Applicable to the Burnaby Site 8 Table 2: Measureable Consequences Specific to Thermal Radiation Incidents 9 Table 3: 2011 KMC Petroleum Properties 11 Table 4: Burnaby Site Existing Tank Storage Details 13 Table 5: Burnaby Site Proposed Expansion Tank Storage Details 14 Table 6: Climatic Stability Class Categories (The Pasquill stability classes) 15 Table 7: Damage Due to Fire and Explosion 17 Table 8: Radiant Heat Study Scenarios 18 Table 9: Summary of Radiant Heat Impact from a Pool Fire 20 Table 10: Summary of Radiant Heat Impact from a Tank Top Pool Fire 22 Table 11: Black Cloud Soot Scenario 24 Table 12: Hazard Distance (SO 2 ) for a Fully Involved Dike Oil Fire 26 Table 14: Probability Data from the Canvey and Rijnmond Reports 27 Table 15: Probability Data from the Center for Chemical Process Safety 27 Table 16: Alberta Highway Dangerous Goods Incident Causes 28 LIST OF FIGURES Figures 1 & 2: Buncefield Tank Farm Fire December Figure 3: Proposed Expanded Site 34 Figure 4: Summary of Risk Distances for Radiant Energy from a Dike Fire (for the 35 existing site and expanded site) Figure 4a: Summary of Risk Distances for Radiant Energy from a Dike Fire (for the 36 existing site and expanded site) Figure 5: Summary of Risk Distances for Radiant Energy from a Tank Top Fire (current site) 37 Figure 6: Summary of Risk Distances for Radiant Energy from a Tank Top Fire (expanded site) 38 Figure 7: Summary of Risk Distances for Radiant Energy from a Dike Fire 39 Figure 8: Risk Management Process 43 Figure 9: MIACC Acceptable Level of Risk Criteria 47 Figure 10: Site Location 49 Figure 11: Site Tank Farm Layout 50 Figure 12: Proposed Burnaby Terminal Expansion 51 Final Report page 2 of 54

3 EXECUTIVE SUMMARY: The risk analysis (March 15, 2011 by Doug McCutcheon and Associates Consulting) of the existing Trans Mountain Pipeline Burnaby site shows the risk to be within the acceptable criteria as recommended by the MIACC Risk Based Land Use Planning guideline. The proposed expansion to 26 tanks also is within the MIACC acceptable risk criteria. The new proposed 14 tank addition including the replacement of one existing tank will see a combination of external floating roof design, fixed roof and possibly geodesic domes. Each of the new tanks are to be fitted with foam addition capability to the internal roof and floating roofs, which will act to provide emergency response needs to a major tank fire incident. There is very little water in the crude streams that are shipped to the site and any water collection with in the tanks will be managed through the high product turnover rate thereby reducing the probability of a boil over scenario. Should such a scenario develop ample time will be available for emergency procedures to implement appropriate action. However, the boil over scenario needs to be referenced in the emergency plan for the site. Each of the individual tanks are located within their own dyked area some will be sufficient to contain a spill of the entire tank contents while others located in the north area of the site will overflow to an internal remote impoundment area. Because all of the crude oil streams and other products can be considered as flammable liquids the need for prevention of releases and ignition sources is required. This hazard and risk analysis is specific to the fire related to a major tank spill and the radiant heat effect of the flames. Included are the analysis of the smoke plume from the fire and a consideration of the Sulphur component in the oil, which has been recognized as a health concern. An oil fire scenario is dependent on the surface area exposed to air. To determine the extent of this area a calculation was completed to represent what such a spill might look like for each of the newly proposed tanks and the remote north impound area. The tank farm design is to the National Fire Code of Canada requirements. Using two tools to characterize the fire scenario with accepted criteria it shows an immediate radius of 86 and up to224 meters will see a direct impact from such a major fire. This distance will reach some areas outside the property line and will need to be included in emergency planning. Another tool was used to calculate the downwind travel distance for a smoke cloud. In most cases the cloud of smoke from a fire will not be a health concern for people exposed downwind. It will be more of a nuisance concern. However as there is a possibility some of the oil will contain small amounts of Sulphur which will be converted to Sulphur Dioxide (SO 2 ) in a fire, the analysis shows a potential health concern could be felt up to 5.2Km downwind. Care to ensure involvement in community communications and needs is apparent here. This issue is typical of other tank farm operations as is shown later with reference to the Buncefield UK incident. The overall risk of 1 X 10 5 for the site is well within the acceptable level of risk criteria as set out by MIACC. Final Report page 3 of 54

4 The main concern is a major tank leak and probability data shows this is potentially possible. Good management practices around operations, inspection and maintenance are required to maintain the risk no higher than 1.0 X In order to ensure the possibility remains low special design and operational features are included. These components should serve to maintain the risk within the acceptable criteria for MIACC. Doug McCutcheon, P.Eng. Final Report page 4 of 54

5 GENERAL REPORT: Trans Mountain Pipeline, for the expansion of the Burnaby site commissioned this risk assessment. The current site involves thirteen storage tanks complete with pumps and facilities within The City of Burnaby near commercial and residential areas but within a forested area. The expanded site will add an additional 14 storage tanks including replacement of one existing tank, to the site on the north and east sides of the site. At this point in time the City of Burnaby does not have a requirement for a risk assessment to be conducted on heavy industrial operations or for new planned projects which could have a possible unwanted impact on their community. This assessment focused specifically on the impact of a flammable liquid fire and how it would impact the surrounding area (see Appendix 3 for a map of the study area). In Canada the determination of acceptable level of risk is made with reference to the Major Industrial Accidents Council of Canada (MIACC) criteria as the guide and best practice in Canada. The specific requirements for each jurisdiction in terms of acceptable levels of risk may vary but the MIACC criteria are broadly accepted throughout Canada. Hence this analysis is guided by the MIACC criteria. See Appendix 2 for an explanation of the MIACC risk criteria. The risk assessment process used was developed over the many years partly as a result of the Bhopal India tragedy in The steps and methods are well established in the industrial world and hence are considered to be the accepted method for doing risk assessments. See Appendix 1 for a flowchart describing the Risk Management methodology. A risk assessment begins with identifying the hazards or concerns. This step relies on regulations and management direction to determine what is considered a hazard or not. The possible scenarios are fire and explosion risks from flammable materials, undesired chemical reactions, and a boil over scenario from an internal tank fire, etc. Since tank leaks & spills are the most likely events to happen, the realistic worst case scenario is a fire and explosion from leaked flammable materials into the containment areas. Even though a boil over scenario is not considered likely, the consequences are very severe. They have been noted as a point of concern by several emergency management groups and therefore are also addressed. Lastly, because the material in the tanks can possibly contain small amounts of Sulphur (see Table 3), the hazard of exposure should be considered for emergency planning purposes. The next steps of the risk assessment process are to examine each hazard for the consequence (impact on the nearby areas) and the probability of occurrence. Once these two calculations are made the risks can be determined and compared to what is considered to be acceptable in Canada, as defined by MIACC. It should be noted that risk calculations do not include emergency planning or other mitigating techniques. The calculations are strictly the "worst case" situations. Emergency plans are developed, once the worst case is known. Once a probability calculation is made there is a need to complete an uncertainty analysis. This involves examining the reliability of the data and the impact of human factors into the equation. The supporting data used from several sources seems sound and with no better source available the analysis is reasonable. The potential for humans to make incorrect decisions is a possible concern. The possibility an incident will happen is there and should not be forgotten. Final Report page 5 of 54

6 Looking over the identified scenarios it is clear the fire scenario for a leaking tank will have the most impact, with radiant heat being the major concern. Smoke from the fire will be a concern too downwind from the site which could be in any direction which was considered relevant for this analysis. Evaluating the consequences of the release scenarios indicated a low level radiant heat impact radius of up to m from a pool fire. Serious impact is felt up to m from the dike walls. A toxic impact up to 5.2km downwind due to SO 2 created in a fire, and smoke impact as far out as 43km. According to the MIACC work the "acceptable level of risk" to the public is set at 1.0 X 10 6 for Canada. This number is not regulated but is referred to in standards and regulations in Canada. It is very much in line with the rest of the world. The value 1 X 10 6 (one in a million) is the annual probability of a fatality to an individual as a result of an industrial incident. In this case there are two concerns: The immediate impact of a radiant heat from a fire on workers and other personnel in the m distance from the dike walls. A toxic cloud containing an ERPG 2 level of SO 2 up to 5.2km downwind. The numbers are reasonable and could be further refined through using actual Trans Mountain experience which may be available. By using valid global data and methodology this risk analysis is in my opinion a valid one. The resulting risks to the public are acceptable. As it stands the risk is acceptable for the proposed expanded tank farm operations. It should once again be noted that risk assessments are done on the worst case scenarios without the activation of mitigation features like application of fire fighting foam or any emergency plans. Trans Mountain should ensure its Emergency Response Plan (ERP) considers co ordination with the Burnaby Emergency Services as appropriate in response to the worst case scenarios described in this report. Doug McCutcheon, P. Eng. Final Report page 6 of 54

7 HAZARD IDENTIFICATION ANALYSIS Every risk assessment needs to begin with the identification of hazards. These types of hazards are then evaluated in terms of the impact they could have on areas outside the property line of the company. The chart below describes the type of hazard and possible concerns over the impact Hazard identification involves the identification of specific undesirable consequences. They can be broadly classified as human impacts, environmental impacts, asset damage impact and business damage impacts. These are relatively straightforward and not difficult to identify. However being thorough in the review is necessary in order to ensure all hazards are uncovered. ADVERSE CONSEQUENCES Human Impacts Environmental Impacts Asset Damage Impacts Business Damage Impacts Consumer injuries Off site contamination Property damage Production outage Community injuries air/ water/ soil Stock value Inventory loss On site personnel On site contamination Insurance premiums Insurance premiums Loss of employment air/ water/ soil Negative image Product quality Psychological effect Lost markets Negative image Legal liability Potential hazards to consider include: Fire Explosion Detonation Corrosion Toxicity Radiation Noise Vibration Noxious Materials Electrocution Asphyxia Mechanical Failure Environmental Impact Insurance Cost Impact Security Breach Impact on the public Lost Company Image Long term exposures Most hazards are seen as personnel safety issues as they pertain to the workers in the particular company operation and rightfully so as they are exposed to the hazards in their daily work activities. Management must be mindful of this priority and focus on the protection of the Final Report page 7 of 54

8 workers in the field. However some may have an impact beyond the fence line of the company s operations. Table 1 below includes some calculated values that can be used to understand more clearly the impact of an incident. We have the ability to determine how much energy can be released from almost any incident, having the knowledge of the consequences as shown below makes for better decision making. These represent consequences of concern for the Burnaby site. Other tables can show consequences of other incident types (like electrical, mechanical, etc.). Table 1: Measurable Consequences Applicable to the Burnaby Site TYPE OF INCIDENT Toxic Release (concentration 1 hour exposure) CONSEQUENCE Odour/Irritation Threshold CONSEQUENCE Irreversible Effects Threshold ERPG 1 ERPG 2 ERPG 3 CONSEQUENCE Life Threatening Effects Threshold Fireball Immediate Ignition (radiation intensity 60 second exposure) Flash Fire Delayed Ignition (flammable gas dispersion) 1st Degree Burns 2 kw/m BTU/hr/ft 2 NOTE there is no lower level consequence 2nd Degree Burns 5 kw/m BTU/hr/ft 2 1/2 of Lower Flammability Limit 3rd Degree Burns 8 kw/m BTU/hr/ft 2 1/2 of Lower Flammability Limit Pool / Jet Fire (radiation intensity 90 second exposure) Unconfined Vapor Cloud Explosion (overpressure) 1st Degree Burns 1 kw/m BTU/hr/ft 2 Window Breakage 0.3 psig 0.02 bar 2nd Degree Burns 4 kw/m BTU/hr/ft 2 Partial Demolition of Houses 1.0 psig 0.07 bar 3rd Degree Burns 6 kw/m BTU/hr/ft 2 Threshold of Ear drum rupture. Lower limit of serious structural damage 2.3 psig 0.16 bar Table 2 below summarizes the impact on the human body from radiant heat energy. The heat one feels coming directly from a flame. Primarily we want to know how far away from the flame one needs to be to remove any potential for fatalities to happen. Well established standards have concluded any people exposed to an energy level lower than 4kW/m 2 for 90 seconds will not be fatally injured. A safe distance as it gives people time to take cover in the event a sudden exposure happens. The analysis will also describe the distance people need to be away from a major fire for levels of 1kW/m 2 which represents sunburn exposure levels. These distances are useful for emergency planning purposes. Final Report page 8 of 54

9 Table 2: Measureable Consequences Specific to Thermal Radiation Incidents (CCPS Guidelines for Chemical Process Quantitative Risk Analysis, second edition 2000 ) Intensity kw/m 2 Consequential Exposure Damage to People Consequential Damage to Equipment 37.5 Significant injury after 10 seconds exposure. 1% lethality after 10 seconds exposure Sufficient to cause damage to process equipment. 100% lethality after 100 seconds exposure 25 Significant injury after 10 seconds exposure. 1% lethality after 30 seconds exposure 100% lethality beyond 100 seconds exposure Minimum energy to ignite wood at indefinitely long exposures & unpiloted Significant injury after 60 seconds exposure. 1% lethality after 80 seconds exposure 9.5 Significant injury after 60 seconds exposure. 1% lethality after 80 seconds exposure Minimum energy required for piloted ignition of wood, melting of plastic tubing No significant damage 4 Significant injury after 90 seconds exposure. No significant damage 1.6 Pain threshold met after 60 seconds No significant damage Definitions Used in Tables 1 and 2: kw/m 2 : are kilowatts per meter squared. A measure of heat energy over a surface area. psig & bar: are measures of pressure ERPG 1: is the maximum airborne concentration below which it is believed that nearly all individuals could be exposed for one hour without experiencing other than mild transient adverse health effects or perceiving a clearly objectionable odour. ERPG 2: is the maximum airborne concentration below which it is believed that nearly all individuals could be exposed for up to one hour without experiencing or developing any irreversible or other serious health effects or symptoms that could impair their abilities to take protective action. ERPG 3: is the maximum airborne concentration below which it is believed that nearly all individuals could be exposed for up to one hour without experiencing or developing life threatening health effects. Final Report page 9 of 54

10 Key Hazard Scenarios and Assumptions 1. Pool Fire The materials are described as condensate to heavy crude oil with the possibility of sulphur content up to 4.79 wt% in some cases. All are rated as flammable material with a flashpoint below 37.8 o C (range is 40 o C up to 20 o C). This is enough to cause the ignition of the oil at any time for the Burnaby area. The tanks are contained in dikes which will contain enough flammable material to fill the dike. In two cases the dikes are designed to overflow to a remote impoundment area where too a flammable liquid fire can take place. The result is a worst case pool fire scenario where all the oil is spilled into the dike and burns. Along with this a more probable event would be a tank top fire which is also considered in this review. 2. Boil over and Fire One other scenario being the Boil over as a result of a fire inside the tank heating the tank contents enough to create a thermal wave downwards boiling any trapped water causing a volume expansion of the oil forcing it to be ejected from the tank into the surrounding area, a very unlikely event but one that is often asked for by emergency response organizations. 3. Toxic Cloud The possibility of a fire creating toxic smoke and possibly some SO 2 having an impacting on the surrounding community. This is expected to be more of a nuisance issue but given the site does store crude oil with a concentration of up to 4.79wt% Sulphur, it may impact the safety of the public. Final Report page 10 of 54

11 Table 3: 2011 KMC Petroleum Properties Final Report page 11 of 54

12 Final Report page 12 of 54

13 TANK NUMBER Table 4: Burnaby Site Existing Tank Storage Details: ASSUMED PRODUCT DIAMETER (m) HEIGHT (m) VOLUME (barrels) AREA (m 2 ) 71 OIL STORAGE K 1, REFINED K 1,052 PRODUCT 73 OIL STORAGE K 1,052 74* OIL STORAGE K 1, OIL STORAGE K 1, OIL STORAGE K 1, OIL STORAGE K 1, OIL STORAGE K 1, OIL STORAGE K 1, OIL STORAGE K 1, OIL STORAGE K 1, OIL STORAGE K 1, OIL STORAGE K 1, MAINLINE RELIEF K 147 *(EXISTING TANK #74 IS TO BE REPLACED WITH A NEW 285,000BBL TANK) Final Report page 13 of 54

14 Table 5: Burnaby Site Proposed Expansion Tank Storage Details: TANK NUMBER ASSUMED PRODUCT DIAMETER (m) HEIGHT (m) VOLUME (barrels) AREA (m 2 ) 74(NEW) OIL STORAGE K 2, OIL STORAGE K 2, OIL STORAGE K 2, OIL STORAGE K 2, OIL STORAGE K 2, OIL STORAGE K 2, OIL STORAGE K 2, OIL STORAGE K 2, OIL STORAGE K 2, OIL STORAGE K 2, OIL STORAGE K 2, OIL STORAGE K 2, OIL STORAGE K 2, OIL STORAGE K 2,240 Final Report page 14 of 54

15 CONSEQUENCE ANALYSIS The consequence analysis is focused on the following possibilities: 1. Scenario one considers the radiant heat impact from a fire as a result of the release of tank contents to the dike area. Also, because some tanks are open top floating roof, consideration is also given to the impact of a tank top fire 2. Scenario two considers smoke created by a release of combustion products which could have an adverse effect on the surrounding community or within the company property lines. 3. Scenario three is a boil over. This is generally a concern for the local emergency services department and has been raised in past reviews for other similar industrial facilities. 4. Overpressure causing projectiles was not considered a concern. The storage tanks are not kept under any pressure and the contents when released will be liquid and not form a vapour cloud, which is needed to create an explosion with enough force to send material outwards beyond the company property line. Atmospheric Conditions: All releases are subject to different scenarios depending on the atmospheric stability at the time of release. Atmospheric stability categories are basically used to describe turbulence. When modeling differing scenarios assumptions need to be made around time of day, wind speed, cloudiness, and the sun's intensity. There are six (6) categories, as shown in Table 4 below, denoted by the letters "A" through "F", with "A" being very unstable, "D" being neutral and "F" being stable. "C" and "B" which are considered to be somewhat unstable are typically used for the Burnaby area. Table 6: Climatic Stability Class Categories (The Pasquill stability classes) Stability class Definition Stability class Definition A very unstable D neutral B unstable E slightly stable C slightly unstable F stable Meteorological conditions that define the Pasquill stability classes Surface wind speed Daytime Incoming Solar Radiation Nighttime cloud cover m/s mi/h Strong Moderate Slight > 50% < 50% < 2 < 5 A A B B E F A B B C E F B B C C D E C C D D D D > 6 > 13 C D D D D Note: Class D applies o heavily overcast skies, at any wind speed day or night Final Report page 15 of 54

16 Scenario One Tank Fire Caused by a Major Oil Tank release Description A pool fire scenario may result in fatalities, damage to nearby facilities and radiant heat exposure. A typical realistic scenario could be a major fire as a result of a major spill to the dike area surrounding a typical oil storage tank. Consequences The consequence analysis focused on the following possibilities: Fatalities due to a fire impact from a release of tank contents to the common impound area, remote impound area or on the tank roof; and Smoke created by a release of combustion products including SO 2 could have an adverse effect on the surrounding community or within the company. (see scenario 2) The impact of a boil over event. (see scenario 3) Methodology Two different tools were used to calculate the potential damage to verify the conclusions. The Dow Fire and Explosion Index will generate an approximate radius of total damage from the fire. The CCPS methodology generates approximate radii for different levels of radiant heat impacts. Both methods are credible. Total Damage Due to Fire and Explosion Using the Dow Method The Dow Fire and Explosion Index is a recognized tool in the field of risk assessments that will determine the radius of major damage as a result of a fire for a particular flammable material and the operation involved. The analysis takes the form of answering several questions using a guide to help attach specific penalties for the operation. These numbers are then used to calculate a circle of exposure and with the information one can determine effective layouts for plant designs to minimize damage and business interruption costs. Credits can also be taken for activities or installations that will reduce the risk. The Dow calculation is based upon over 160 actual incidents in industry and the results from those fires have been developed into a detailed calculation. This specific analysis is required by regulation in many locations around the world. The calculation assumes a flammable composition that will be enough to start the fire. As there is a small amount of sulphur & benzene in the oil it may cause the fire department to proceed with more care while responding to a fire. This is incorporated into the calculation to some degree. The resulting calculations, albeit very general, indicate a total damage distance of 21 meters from the dike wall for a spill from an oil tank large enough to fill a dike surface area. This is the radius of total destruction for any equipment within the 24m radius of the dike wall and is a similar distance to the CCPS method covered next of 17m. Final Report page 16 of 54

17 Table 7: Damage Due to Fire and Explosion (Using the Dow Chemical Fire and Explosion Index calculation 7 th edition) MATERIAL FACTOR General Process Hazards Penalty Factor Range Penalty Factor Used Base Factor A. Exothermic Chemical Reactions 0.30 to 1.25 B. Endothermic Processes 0.20 to 0.40 C. Material Handling and Transfer 0.25 to D. Enclosed or Indoor Process Units 0.25 to 0.90 E. Access 0.20 to F. Drainage and Spill Control 0.25 to General Process Hazards Factor (F1) Special Process Hazards Base Factor A. Toxic Material(s) 0.20 to B. Sub Atmospheric Pressure (<500 mm Hg) 0.50 C. Operation in or Near Flammable Range Inerted Not Inerted 1. Tank Farms Storage Flammable Liquids Process Upset or Purge Failure Always in Flammable Range 0.80 D. Dust Explosion 0.25 to 2.00 E. Pressure Operating Pressure psig or kpa gauge Relief Setting... psig or kpa gauge F. Low Temperature 0.20 to 0.30 G. Quantity of Flammable/Unstable Material: Quantity 96,083,000lb Hc = 21,300BTU/lb 1. Liquids or Gases in Process 2. Liquids or Gases in Storage Combustible Solids in Storage, Dust in Process H. Corrosion and Erosion 0.10 to 0.75 I. Leakage Joints and Packing 0.10 to 1.50 J. Use of Fired Equipment K. Hot Oil Heat Exchange System 0.15 to 1.15 L. Rotating Equipment 0.50 Special Process Hazards Factor (F2) 2.8 Process Unit Hazards Factor (F1xF2) = F Fire and Explosion Index (F3xMF = F&EI) Radius of Exposure 78ft or 24m Final Report page 17 of 54

18 Total damage and Radiant Heat Damage Using the CCPS method (Using the CCPS Guidelines for Chemical Process Quantitative Risk Analysis Second edition) The Dow method is specific to the destruction of equipment and facilities and is used for effective layout design decisions. This method calculates the distance to the 37.5 kw/m 2 radiant heat impact level. It does not include radiant heat exposure to people. In order to define the impact on people the CCPS method provides for that outcome. The same realistic scenario is used for both calculations. That being a pool fire resulting from a spilled tank with the contents contained inside the dike walls. Should this catch fire the dike surface area would be used for calculating the fire scenario. A fully developed tank top fire is also considered. For radiant heat exposure the method used is a well established tool generated through the American Institute of Chemical Engineers. The methodology received a peer review from chemical engineering experts and is well respected and recognized. (CCPS Guidelines for Chemical Process Quantitative Risk Analysis Second edition) Assumptions and Calculations 1. Dike areas: a. There are 14 new tanks including replacement of one existing tank each within a containment dike or overflow to a remote impound area. b. The tanks are 53.4m, 56.4m and 60.95m in diameter c. The expansion will see six of the new tanks along the northern boundary of the site, 6 new tanks on the east side and 2 new tanks within the existing site tank layout with the remote impound area inside the existing site. The tanks along the north and east boundaries will have an increased impact outside the property line. d. The dike areas available to hold spills (includes area taken up by the tanks) are approximate and shown in Table 8 below. By using these surface areas the calculations represent the worst case scenarios for dike fires and the worst case situation. Table 8: Radiant Heat Study Scenarios (Based on common tank dike collection surface areas) Scenario Available Spill Area (m 2 ) Average Pool Diameter (m) Average Pool Radius (m) 1. Tanks 96 & 98 6, Tanks 91, 93 and 95 13, Tank 97 4, Impound Area 7, Tank 80 (includes tank 86 11, dike area) 6. Tank 89 (includes tanks 71, 9, & 85 dike areas) 7. Tanks 74, 76 and 78 15, Tanks 75, 77 and 79 16, Final Report page 18 of 54

19 2. It is calculated that for all but three (Tanks #96, 97 & 98) of the proposed tanks, one tank volume will fill the dike area. Tanks #96, 97 & 98 will need to overflow to the remote impound area. This is important for these calculations as this represents the fuel source where the oil is exposed to air. 3. As the contents of all tanks are considered flammable the worst case scenario is focused on radiant heat from a pool fire resulting from a spill that covers the surface area of the dike. 4. From the CCPS Guideline, a fire involving heavier hydrocarbons emit a power level of kw/m 2 if there is no smoke. Smoke from the fire will shield the radiant heat down to kw/m 2. The smoke scenario is more realistic than the smokeless scenario, but both scenarios are calculated to show the difference. 5. Flame height from such a large fire will be in the order of 59.3m to 110.6m above the liquid surface. Using a mass burning rate for gasoline, as no other was available, the result is a conservative value for flame height (that is the highest possible). 6. Assuming the entire dike area is on fire the average energy release will be in the order of 20 kw/m 2 up to 60kW/m 2. However occasionally in a fire scenario the flame will not be clouded by smoke emitting a more intensive radiant heat for short periods of time so the 110 kw/m 2 values are also provided as information. 7. Using a View Factor, which is consideration for height of the flames and distance from the source, the following distances the radiant heat flux values were determined: Final Report page 19 of 54

20 Table 9: Summary of Radiant Heat Impact from a Pool Fire (Fully Involved Resulting from a Major Tank Release to the Dike Area) Intensity Consequential Exposure kw/m 2 Damage to People Distance (meters) From Edge of dike wall (Smokeless Fire kw/m 2 ) 37.5 Tank #96 & 98 = 7.4 Tank #91, 93 & 95 = 1.6 Tank #97 = 7.4 Impound Area = 11 Tank #80 & 86 = 15 Tank #89, 71, 73 & 85 = 17 Tanks #74, 76 & 78 = 17 Tanks #75, 77 & 79 = Tank #96 & 98 = 26 Tank #91, 93 & 95 = 55 Tank #97 = 24 Impound Area = 38 Tank #80 & 86 = 53 Tank #89, 71, 73 & 85 = 63 Tanks #74, 76 & 78 = 58 Tanks #75, 77 & 79 = Tank #96 & 98 = 44 Tank #91, 93 & 95 = 94 Tank #97 =41 Impound Area = 65 Tank #80 & 86 = 91 Tank #89, 71, 73 & 85 = 107 Tanks #74, 76 & 78 = 100 Tanks #75, 77 & 79 = Tank #96 & 98 = 73 Tank #91, 93 & 95 = 156 Tank #97 = 68 Impound Area = 108 Tank #80 & 86 = 152 Tank #89, 71, 73 & 85 = 179 Tanks #74, 76 & 78 = 166 Tanks #75, 77 & 79 = Tank #96 & 98 = 117 Tank #91, 93 & 95 =250 Tank #97 = 110 Impound Area = 203 Tank #80 & 86 = 243 Tank #89, 71, 73 & 85 = 709 Tanks #74, 76 & 78 = 266 Tanks #75, 77 & 79 = Tank #96 & 98 = 220 Tank #91, 93 & 95 = 468 Tank #97 = 205 Impound Area = 324 Tank #80 & 86 = 456 Tank #89, 71, 73 & 85 = 536 Tanks #74, 76 & 78 = 498 Tanks #75, 77 & 79 = Tank #96 & 98 = 300 Tank #91, 93 & 95 = 640 Tank #97 = 281 Impound Area = 443 Tank #80 & 86 = 623 Tank #89, 71, 73 & 85 = 733 Tanks #74, 76 & 78 =681 Tanks #75, 77 & 79 = 713 Distance (meters) From Edge of dike wall (Heavy smoke Fire kw/m 2 ) Tank #96 & 98 = 0 Tank #91, 93 & 95 = 0 Tank #97 = 0 Impound Area = 0 Tank #80 & 86 = 0 Tank #89, 71, 73 & 85 = 0 Tanks #74, 76 & 78 = 0 Tanks #75, 77 & 79 = 0 Tank #96 & 98 =3.7 Tank #91, 93 & 95 = 7.8 Tank #97 = 3.4 Impound Area =5.4 Tank #80 & 86 = 7.6 Tank #89, 71, 73 & 85 = 8.9 Tanks #74, 76 & 78 = 8.5 Tanks #75, 77 & 79 = 8.7 Tank #96 & 98 = 26 Tank #91, 93 & 95 = 55 Tank #97 = 24 Impound Area = 38 Tank #80 & 86 = 53 Tank #89, 71, 73 & 85 = 62 Tanks #74, 76 & 78 = 58 Tanks #75, 77 & 79 = 61 Tank #96 & 98 = 40 Tank #91, 93 & 95 = 86 Tank #97 = 38 Impound Area = 59 Tank #80 & 86 = 84 Tank #89, 71, 73 & 85 = 98 Tanks #74, 76 & 78 = 91 Tanks #75, 77 & 79 = 96 Tank #96 & 98 = 91 Tank #91, 93 & 95 =195 Tank #97 = 86 Impound Area = 135 Tank #80 & 86 = 190 Tank #89, 71, 73 & 85 = 224 Tanks #74, 76 & 78 = 208 Tanks #75, 77 & 79 = 218 Tank #96 & 98 = 179 Tank #91, 93 & 95 = 382 Tank #97 = 168 Impound Area = 265 Tank #80 & 86 = 372 Tank #89, 71, 73 & 85 = 438 Tanks #74, 76 & 78 = 407 Tanks #75, 77 & 79 = 426 Tank #96 & 98 = 219 Tank #91, 93 & 95 = 468 Tank #97 = 205 Impound Area = 324 Tank #80 & 86 = 456 Tank #89, 71, 73 & 85 = 536 Tanks #74, 76 & 78 = 498 Tanks #75, 77 & 79 = 522 Significant injury after 10 seconds exposure. 1% lethality after 10 seconds exposure 100% lethality after 100 seconds exposure Significant injury after 10 seconds exposure. 1% lethality after 30 seconds exposure 100% lethality beyond 100 seconds exposure Significant injury after 60 seconds exposure. 1% lethality after 80 seconds exposure Significant injury after 60 seconds exposure. 1% lethality after 80 seconds exposure Significant injury after 100 seconds exposure. Pain threshold met after 60 seconds First degree burns can be felt after 90 seconds exposure Consequential Damage to Equipment Sufficient to cause damage to process equipment. Minimum energy to ignite wood at indefinitely long exposures & unpiloted. Minimum energy required for piloted ignition of wood, melting of plastic tubing No significant damage No significant damage No significant damage No significant damage Final Report page 20 of 54

21 Summary For a fully involved dike fire, the type of fire will undoubtedly be a heavy smoke type. With this in mind the major damage is up to 17 meters from the dike wall similar to the Dow calculation of 24 meters. The damage quickly reduces as the radiant heat energy is dissipated outwards. Applying the MIACC Criteria for 4 kw/m 2, the acceptable level of risk radius is approximately m from the dike wall. The radiant heat energy eventually declines to 1.0 kw/m 2 (sunburn) at a distance of meters from the dike wall. Of note are the specific tanks close to the northern and eastern boundaries where the impacts can be felt beyond the company property lines. Table 10: Summary of Radiant Heat Impact from a Tank Top Pool Fire (Fully Involved) Intensity kw/m 2 Distance (meters) From Centre of the Tank (Smokeless Fire kw/m 2 ) Distance (meters) From Centre of the Tank (Heavy smoke Fire kw/m 2 ) Consequential Exposure Damage to People Significant injury after 10 seconds exposure. 1% lethality after 10 seconds exposure 100% lethality after 100 seconds exposure Significant injury after 10 seconds exposure. 1% lethality after 30 seconds exposure 100% lethality beyond 100 seconds exposure Significant injury after 60 seconds exposure. 1% lethality after 80 seconds exposure Significant injury after 60 seconds exposure. 1% lethality after 80 seconds exposure Significant injury after 100 seconds exposure. Consequential Damage to Equipment Sufficient to cause damage to process equipment. Minimum energy to ignite wood at indefinitely long exposures & unpiloted. Minimum energy required for piloted ignition of wood, melting of plastic tubing No significant damage No significant damage Pain threshold met after 60 seconds No significant damage First degree burns can be felt after 90 seconds exposure No significant damage Summary For a tank top fire, the type of fire will undoubtedly generate heavy smoke. With this in mind the major damage is up to meters from the source of the fire. The damage quickly reduces as the radiant heat energy is dissipated outwards. Applying the MIACC Criteria, for 4kW/m 2, the acceptable level of risk radius is approximately m from the source. The radiant heat energy eventually declines to a safe level equivalent to a sunburn at about meters. Final Report page 21 of 54

22 Scenario Two Toxic Cloud Release from a Fire Two concerns are identified: 1. The development of a black cloud of soot as a result of the hydrocarbon fire and the distance that cloud could drift. That was the case for the Buncefield fire incident (pictures shown below) late in 2005 in the UK. This oil storage facility contains several storage tanks within dikes, similar to the Burnaby site. 2. The second issue is the combustion products of oil with sulphur content. There is a potential for crude oil with Sulphur content up to 4.79wt% to be stored on site. This could be significant in the case of fire where the sulphur is converted to SO 2. Part of the review incorporates the effects of mixing as the combustion gases rise in the heat created by the fire. A worst case view is developed. Black Cloud of Soot Scenario: Using the Dow Chemical Exposure Index and carbon black as the composition of concern, a distance was roughly calculated to show how far downwind a cloud of smoke would travel. The ERPG 2 value for carbon black is a recognized health hazard concentration. The scenario considered included the distance to the minimum concentration that would be considered dangerous to health (ERPG 2). A fire would create thermal effects that would create a high cloud that could drift in any direction from the site depending on wind direction. Figures 1 & 2 Buncefield Tank Farm Fire December 2005: Smoke distribution Final Report page 22 of 54

23 Table 11: Black Cloud Soot Scenario Component of the combustion product is assumed to be Quantity kg/sec ERPG 1 mg/m 3 Odour ERPG 2 mg/m 3 10 min. Release Rate Distance to ERPG 2 (km) Smoke, CO 2 CO, Carbon from a dike fire case Smoke, CO 2 CO, Carbon from a tank top fire case N/A 3.5 ~ 43 km N/A 3.5 ~ 18 km Dike area: (Use the largest dike area which will be for tanks 75, 77 and 79) Area = 16,892m 2, assuming 2 5 cm/hr. are burned. Average burn rate = 3.5 cm/hour (0.035 m/hour) Amount burned = (0.035m/hr)(16,892 m 2 )/3,600 = m 3 930kg/m 3 (Average density for oils handled) = 152.5kg/sec Using the Time Weighted Average (TWA) for Carbon Black as no other values available the resulting possible cloud with carbon particles could drift to create an EREPG 2 distance of ~41km downwind from the fire. Tank Top Fire (61m diameter tank): Area = 2,922 m 2, assuming 2 5 cm/hr. are burned. Average burn rate = 3.5 cm/hour (0.035 m/hour) Amount burned = (0.035m/hr)(2,922 m 2 )/3,600 = m 3 930kg/m 3 (Average density for oils handled) = 26.4kg/sec Again using the Time Weighted Average for Carbon Black as no other values available means a possible cloud with carbon particles could drift to create an ERPG 2 distance of ~13km from the fire. ERPG 1: is the maximum airborne concentration below which it is believed that nearly all individuals could be exposed for one hour without experiencing other than mild transient adverse health effects or perceiving a clearly objectionable odour. ERPG 2: is the maximum airborne concentration below which it is believed that nearly all individuals could be exposed for up to one hour without experiencing or developing any irreversible or other serious health effects or symptoms that could impair their abilities to take protective action. ERPG 3: is the maximum airborne concentration below which it is believed that nearly all individuals could be exposed for up to one hour without experiencing or developing life threatening health effects. Final Report page 23 of 54

24 Sulphur Dioxide Cloud from burning Sulphur Scenario: Using the Dow Chemical Exposure Index and sulphur dioxide as the product of combustion and the composition of concern, a distance was roughly calculated to show how far downwind a worst case scenario would travel. The calculations considered how far down wind would a concentration for ERPG 1 (odour level), ERPG 2 (emergency planning level), ERPG 3 (health concerns) and IDLH (Immediately Dangerous to Life and Health) would travel. The scenario considered included the distance to a concentration that would be of concern. The data is very worst case. It is difficult to take into consideration the efficiency of converting the Sulphur compounds to SO 2 and the effects of dilution of the combustion gases in the thermal heat as the cloud rises and mixes with air near the fire. It is important to recognize a fire involving a sour crude oil spill can develop with a resulting smoke composition including SO 2. It is assumed a fire would create a high cloud due to thermal effects from the fire that could drift in any direction from the site. The maximum concentration of Sulphur components is 4.79wt%. From previous calculations the burn rates were: 152.5kg/sec for the dike fire 26.4kg/sec for the tank top fire Using the maximum concentration of Sulphur at 4.79wt% the quantity of Sulphur liberated as SO 2 in a fire is: The chemistry of fire is: S + O 2 SO 2 The mole ratios are 1 mole S + 1 mole O 2 1 mole SO 2 Therefore we can say the burning rate yields (0.0479) (152.5kg/sec) = 7.30 kg/sec Sulphur for the dike scenario, and (0.0479) (26.4kg/sec) = 1.27 kg/sec Sulphur for the tank top fire scenario. The type of fire does not allow for effective mixing of air and fuel and will result in incomplete combustion (as demonstrated by the black smoke and soot). This means a portion of the Sulphur will not be converted to SO 2. From Lees (Loss Prevention in the Process Industries second edition) and Dow Chemical experience the efficiency of such a fire ranges from 70% 90% for heavy liquid fuels such as oils. For a 70% efficiency the Sulphur converted to SO 2 would be: (0.0479) (152.5 kg/sec)(70%) = 5.11 kg/sec sulphur for the dike scenario, and (0.0479) (26.4 kg/sec)(70%) = 0.89 kg/sec sulphur for the tank top fire scenario. The following table (Tables 12 and 13) shows the result of 100% combustion and 70% combustion efficiencies using the Dow Chemical Exposure Index Calculation second edition for the hazard distance. Final Report page 24 of 54

25 Table 12: Hazard Distance (SO 2 ) for a Fully Involved Dike Oil Fire Toxic Exposure Level Value (mg/m 3 ) 100% Combustion Efficiency 70% Combustion Efficiency ERPG 1 (Odour level) ERPG 2 (Emergency planning level) km 14.8 km km 5.2 km ERPG 3 (Impacting people s health) km 2.4 km IDLH (Immediately Dangerous to Life and Health level) km 0.9 km Table 13: Hazard Distance (SO 2 ) for a Fully Involved Tank Top Oil Fire Toxic Exposure Level Value (mg/m 3 ) 100% Combustion Efficiency 70% Combustion Efficiency ERPG 1 (Odour level) ERPG 2 (Emergency planning level) 1 7.4km 6.2 km km 2.2 km ERPG 3 (Impacting people s health) km 1.0 km IDLH (Immediately Dangerous to Life and Health level) km 0.4 km Summary: Toxic concerns were identified for smoke (soot) and for SO 2 downwind of the site. These are both issues that should be included in the site emergency plan. From a risk exposure point of view the impacts are very hard to define due to weather conditions and just the turbulence created by the heat from a fire. The likely result will be significant mixing of any SO 2 in the air to reduce the impact at ground level. However it cannot be ignored that the emergency plan needs to extend outwards to 5.2km for SO 2 concerns assuming 70% combustion efficiency. The Buncefield UK experience in terms of smoke impacts as shown in the above photographs gives a vivid picture of what a similar fire could look like. Final Report page 25 of 54

26 Scenario Three Boil Over Boil over is a specific fire scenario with very large impacts and it is specific to storage tanks of oil product mixtures with water present. It is hard to model so this analysis will simply express the concern and some of the actions needed to manage the risk from them. Typical oil storage facilities will handle crude oil, which consists of several components some lighter and more volatile (flammable) than the others. It goes without saying that the oil will also contain some water (in this case often around 0.5%), which can accumulate in the tank and form a layer or lens as water or an emulsion. These lighter components can catch fire in open tank storage and if sufficient enough will continue to burn eventually starting to burn the heavier oil below its interface. This will continue to heat the contents of the tank as well as produce heavier residue from the combustion process, which will accumulate at the top of the tank. As the fire continues this heavier residue will eventually sink and cause a thermal wave because it is hot (some o C). As the residue layer sinks and comes in contact with the water layer (lens) the water immediately boils and expands in volume some 2,000 times as it converts to steam. This violent conversion will eject the hot burning oil layers above the tank into the air (as high as 1,000 meters above the tank). This scenario is considered to not be a factor in this analysis. The tank design follows recommended practices with respect to preventing boil over scenarios. The tanks do, however, have an external floating roof. It should be noted the oil being stored in the tank will contain some water (0.05wt%) and if this water is not managed (i.e. routinely removed) the water lens can develop. My understanding is the design and management procedures are intended to monitor for and remove water layers from the tank(s). There are some requirements under NFPA 30 for such concerns, which should be reviewed. It is also of note that the tanks are equipped with foam application capability. Having an inerting capability along with the planned foam addition to the floating roof may be something else to consider. Final Report page 26 of 54

27 PROBABILITY ANALYSIS and HUMAN RELIABILITY ANALYSIS Probability Calculations: Failure data for several situations have been identified through various analyses around the world. Below are a few databases, which would be appropriate for these circumstances. These databases have been developed as research projects and have undergone rigorous peer review to ensure their validity. Normally, company databases will provide a more accurate probability, however few companies collect this data. The probability data shown in Tables 14 and 15 are used for this analysis. Table 14: Probability Data from the Canvey and Rijnmond Reports Type of failure Canvey Report # Incidents / year Rijnmond Report # Incidents / year Pipe leak Tank leak Railcar derail & spill Pump failure 3 X 10 4 /km 1 X 10 6 /km traveled 1 X X 10 8 to 1 X X 10 4 to 6 X X 10 4 Hose failure Valve opening (relief valve) Truck road spill incident 4 X 10 5 to 4 X X 10 5 to 3.6 X X 10 8 /km traveled Data from the UK HSE analysis of incidents 1978 and from the Netherlands review 1982 for Rotterdam link to the North Sea. Table 15: Probability Data from the Center for Chemical Process Safety Type of failure Center for Chemical Process Safety Mean Time Between Failures (MTBF) Operator error (serious 252,000 hours or once per 28 years (3.5 X 10 2 ) incident) Detection system failure 220,000 hours or once every 25 years Truck loading or unloading 1,156,000 hours or once every 131 years failure Spills and leaks 148,000 hours or once every 17 years Process control system 167,000 hours or once every 19 years failure Data from an analysis of LNG plants by CCPS (1 year = 8,760 hours) Data is also per person, per system, per truck operation, per tank. Annual Probability of note for these scenarios: The above databases along with EUB and Alberta highway statistics provide for the following probabilities: Tank Leaks from 1 X 10 4 to 6 X 10 6.incidents per year Pump failure at 1 X 10 4 incidents per year Piping leak from 1 X 10 8 to 1 X incidents per year Pipeline leaks 8.9 X 10 4 / kilometer (ERCB Pipeline Statistics) Hose failure from 4 X 10 5 to 4 X 10 6 incidents per year Operator error 1/28 years Human Factors are involved in 47.5% of all dangerous goods incidents Final Report page 27 of 54

28 Uncertainty Analysis: The probability data used above is reasonable and straightforward. There will be some uncertainty brought on by: Changes to contents of tanks as a result of business swings Possible reactive chemistry often overlooked. Individual exotherms that can happen at different temperatures. Similarly, the reaction of one chemical with another when inadvertently transferring to the wrong tank for example. Expansion needs in the future may bring in unacceptable products. Changes to the operations from the norm. Impact of human error For this study only human error has been considered an issue and is discussed next. Human Reliability Analysis: The probability values shown in Tables 14 and 15 above involve actual incidents of which a large number were initiated by human activities and are referred to as human factors issues. There are very few databases available to draw from on this topic but through Alberta Transportation and the Center for Chemical Process Safety in the US some numbers are provided to emphasize the importance of this topic. The probability data in Tables 14 and 15 already contain this human factors component. The result provides insight as to why management oversight is needed to ensure appropriate management elements are in place to prevent incidents from happening. This is the box labeled Manage the Residual Risk in the Risk Management Process (Appendix 1 ). Alberta Historical Analysis of Highway Dangerous Goods Incidents 1991: Abstract of Paper Alberta Public Safety Services is the provincial department concerned with the transportation of dangerous goods on Alberta highways, the enforcement of Canadian legislation, and the response to dangerous goods incidents on the highways. Traditional vehicle accident reporting methods do not necessarily reflect the true cause of an incident, and an analysis of the incidents occurring in the province during 1991 was done to assess the human error factor in dangerous goods spills in the province. Much of the analysis is based on post accident investigation, but there appears to be sufficient data to point to human error, opposed to mechanical failure, as a significant factor in dangerous goods incidents. Industry response to suggestions for improvements has been positive, and has reduced the incident frequency in some areas. Table 16: Alberta Highway Dangerous Goods Incident Causes Cause 1 st Q 2 nd Q 3 rd Q 4 th Q Total % Environment Human Factor Insecure Equip. Failure Unknown Vandals Packaging Other Total (From Hammond & Smith Table 3 "Causes") Final Report page 28 of 54

29 Note the statistics from Alberta Transportation showed 47.5% of highway incidents have some human factor component involved. Also note the data from the Center for Chemical Process Safety in the US shows a significant incident as a result of operator error will happen once every 28 years. Human involvement has proven to be often at the root of the causes for incidents. And these causes are shown to be management failings for the most part. To do a thorough analysis would be something that may be useful if the overall scope of the project is to reduce the probabilities. For now the human factor is included in the data used, it just has not been differentiated from other causes. Suffice it to say management systems focused on people and their actions is important. Probability of Fire: All spills do not catch fire, in fact only a small number do. The probability of fire as a result of a spill is low but can happen. Most data is with respect to LPG leaks where the fuel is considered to be flammable as is the case here. Data from a transportation of dangerous goods report for a major LPG release at a derailment shows only 5% of leaks catch fire. (Reference Used for this analysis came from (Alp, E., Portelli, R. V., & Crocker, W. P. (1992). Rail Transport Risk in the Greater Toronto Area: presentation to the First International Consensus Conference on the Risks of Transporting Dangerous Goods, Toronto April 1992.) Additional information from Lees (Loss Prevention in the Process Industries second edition), indicate for large releases of heavier products (such as oil and at a rate of 150 Kg/sec) the likelihood of catching fire is 10%. For smaller flow rates like 10 20kg/sec the probability drops to 3%. Consequently, using a value of 10% of leaks catching fire is appropriate and conservative. Summary: From an operational view there is a higher than accepted probability for releases caused through the handling of materials during transfers as well as through tank leaks and spills. Any operation that involves opening equipment is also noted such as the pig launching station or maintenance activities around the pumps, tank mixers, filters and meter runs. The worst case scenarios are concerned with fire situations and the probability of having an ignited release. The likelihood of a release catching fire is relatively low. Conservatively for this analysis it is in the order of 10% (1X 10 1 ). Therefore the probabilities for the chosen scenarios would be in the order of: Probability of a fire as a result of a tank leak = (1X 10 1 ) (1 X 10 4 to 6 X 10 6 ) = 1.0 X 10 5 to 6.0 X 10 7 Pump failure leading to a fire = (1X 10 1 ) (1 X 10 4 ) = 1 X 10 5 Final Report page 29 of 54

30 Piping leak leading to a fire = (1X 10 1 ) (1 X 10 8 to 1 X ) = (1 X 10 9 to 1 X ) Pipeline leaks leading to a fire = (1X 10 1 ) (8.9 X 10 4 / kilometer) = 8.9 X 10 5 per km. These probabilities (as high as 1.0 X 10 5 ) are within the 1 X 10 5 value considered to be acceptable for the industrial area as defined by MIACC (see Appendix 2 ). For the most part the expected probability would be well within the 1 X 10 6 value for residential and higher density developments. This is to say the risk would meet the MIACC requirements. Sound design, collection of leaks, fire protection systems, operational management, emergency planning and other activities will serve to effectively maintain the risk to an acceptable level. Final Report page 30 of 54

31 RISK ANALYSIS Risk: Risk is the combination of consequence and probability. It is often referred to as: "Risk = Consequence X Probability" The consequences of concern for the realistic worst case scenario (a fire with heavy smoke) are: Radiant heat exposure to workers and anyone within 224m of the dike walls represents an exposure of 4kW/m 2 from a dike fire. For a tank top fire that distance shrinks to 71m from the dike wall. It seems impossible but at a distance of 536 m from a dike fire and 184m for a tank top fire the public will feel the heat and could be exposed to 1 kw/m 2 which is are for 1 st degree type burns (sunburn level). The impact of a SO 2 cloud can be felt 5.2km downwind from a crude oil fire. The impact of a large volume of smoke as a result of a fire could extend outwards for approximately 43 km. causing possible public outrage. The probability of a leak event resulting in a fire is 1.0 X 10 5 to 6.0 X This is within the acceptable level of risk for Canada as it meets the MIACC criterion. These probability numbers are acceptable. There is a range of a little more than one order of magnitude shown which is acceptable because the top of the probability range meets the MIACC criteria of 1.0 X As a result it is reasonable to conclude the site risk management activity should maintain the risk as acceptable. Sound design, collection of leaks, fire protection systems, operational procedures, emergency planning and other activities will serve to effectively manage the risk to an acceptable level. Final Report page 31 of 54

32 CONCLUSIONS Discussion of Results: 1. The type of fire will most certainly have smoke providing for less radiant energy to be transmitted horizontally. 2. The probability of an incident happening is low enough when compared to the acceptable level of risk identified by the MIACC. This probability equates to 1 X 10 5 up to about meters from the dike wall for a fully involved dike fire, which is acceptable for an industrial area. Similarly the tank top fire will present a lower level consequence with exposures meters from the dike wall for that specific tank. The consequences are known and although they may expose a small number of members of the public (people not normally in the industrial area) an effective reaction to an incident itself should appropriately address most of the situations. Recognition of this should be included in the emergency planning. 3. Some industries are now focused on improving the area of human interface with their operations and equipment. As noted in the probability analysis this is an area where significant improvement can be made to reduce the risk. Effective risk reductions can be made during the design stages. 4. The potential for major leaks from tanks, hoses, pipes and equipment are areas of focus. Attention to this potential for impacting the risk warrants consideration. More inspection, testing and maintenance activities than what would be considered to be normal may be an area to consider. The annual probability of a tank leak only (Rijnmond Report) ranges from 1 X 10 4 to 6 X This means some additional attention to monitoring tank integrity will assist to keep the risk of a fire within the MIACC criteria. 5. The accumulation of water in lenses inside each tank was discussed, which is of concern. Having the appropriate management operations strategies in place to remove water will reduce any boil over scenario probability. 6. The tank designs include a steel cone roof or Aluminum dome roof with either an internal steel pontoon floating roof or a light weight Aluminum internal floating roof which will trap flammable mixtures. The tanks are designed to have the ability to apply fire fighting foam to the floating roof seal if needed. Foam can also be applied to the full tank area in case of a roof failure. 7. Nearby workers will be exposed to the effects of a major tank or tank area fire. Although workers can seek protection indoors from the radiant heat evacuation requirements will be needed for beyond the meter distance in the event of a fire. Final Report page 32 of 54

33 8. Toxic SO 2 is a concern. The analysis shows SO 2 levels can extend outwards 5.2km for a dike fire and 2.2km for a tank top fire should a crude tank catch fire. Although the analysis tries to pick the realistic scenario where combustion efficiency is 70% the difference in distances to the ERPG 2 levels is not very much more for 100% combustion. Appropriate emergency planning involving foam addition and shelter inplace or evacuation plans is needed. 9. Smoke in terms of a black cloud will drift downwind (43km for a dike fire and 18km for a tank top fire). It will be heavier than air as it cools it will bring particulates of soot to ground level. Based on health data gathered from the Buncefield fire in the UK in December 2005 no health issues would be anticipated as a result of soot from these fire scenarios. Final Report page 33 of 54

34 Figure 3: Proposed Expanded Site Final Report page 34 of 54

35 Figure 4: Summary of Risk Distances for Radiant Energy from a Dike Fire (for the existing site and expanded site) Risk Level = 1 X 10 5 to the 4kW/m 2 radiant heat intensity. Existing site Expansion Final Report page 35 of 54

36 Figure 4a: Summary of Risk Distances for Radiant Energy from a Dike Fire (for the existing site and expanded site) Final Report page 36 of 54

37 Figure 5: Summary of Risk Distances for Radiant Energy from a Tank Top Fire (current site) Risk Level = 1 X 10 5 to the 4kW/m 2 radiant heat intensity. Final Report page 37 of 54

38 Figure 5: Summary of Risk Distances for Radiant Energy from a Tank Top Fire (expanded site) Risk Level = 1 X 10 5 to the 4kW/m 2 radiant heat intensity. Final Report page 38 of 54

39 Figure 7: Summary of Risk Distances for Radiant Energy from a Dike Fire MIACC criteria 1 X 10 5 shown as 224meters Radiant energy equivalent to the level of sunburn shown as 536 meters 2 Mile radius (3.2 Km) Pipeline network Final Report page 39 of 54

40 Conclusions: 1. The risks that are of concern are the pool fire inside the dyked area, the potential for a boil over incident and the smoke generated by a major fire. The greatest risk is a pool fire. The calculation assumes the fire will be vertical with no wind present. However any wind will affect the flame slightly, which in turn could affect the radiant heat impact distance. However the differences are insignificant because of the large distance of the impacted area. 2. A 4kW/m 2 radiant heat impact will be felt for a distance up to 224m from the dike wall. This includes the site and the road network to the northeast of the site. Of interest is the residential area directly to the south of the site, although the risk levels are acceptable consideration for emergency planning needs is suggested. Other than that there is not much beyond the property line other than a forested area. This heat intensity will cause significant injury to people after 100 seconds of exposure but there will not be any significant damage to equipment. Further away at 536m from the dike wall, the radiant energy reduces to 1 kw/m 2 which will cause 1 st degree burns (sunburn) after 90 seconds of exposure. 3. A cloud of black soot (smoke) will drift as far as 43km downwind (very rough estimate). 4. The risk of exposure to SO 2 above the ERPG 2 level will extend as far as 5.2km from the site. A real concern and requires adequate attention in terms of emergency planning. 5. The risks will be within the MIACC criteria for an industrial area as well as the public at large. Risk levels of 1.0 X 10 5 for the industrial area down as low as 6.0 X 10 7 have been compiled. Although these risk levels will be within the MIACC criteria, the need for good design, quality components and operational management attention to the tank, dike wall and pumps are required. 6. Having an emergency plan in place with the ability for foam addition, and good road access from at least 2 directions is imperative. 7. The boil over scenario is highly unlikely but it s of importance has been pointed out by several Emergency Services Departments over the years. It is noted that similar incidents have caused major damage for several kilometers outward, and therefore emergency planning must include a response for this event. Final Report page 40 of 54

41 Appendices 1. Risk Management Process 2. Risk Analysis & Acceptable Level of Risk 3. Maps of the Area 4. References Final Report page 41 of 54

42 Appendix 1 The Risk Management Process Final Report page 42 of 54

43 THE RISK MANAGEMENT PROCESS The process used to do s follow this globally accepted methodology. The proposal presented above is in line this method. This risk management process represents what is practiced around the world particularly for hazardous industries but including others. Each step requires different activities to be conducted in differing formats. The result is a process that has been used successfully globally for over25 years and is considered to be the best we currently have. Figure 8: Risk Management Process DOING PLANNED REVIEWS IDENTIFICATION OF HAZARDS Management activities to track company actions against policy. REDUCE THE RISK RISK ASSESSMENT/ ANALYSIS Scope of work for this study Can The Risk BE REDUCED? Yes No Is THE RISK ACCEPTABLE? Risk analysis activities to track, look for and analyze hazards or concerns that arise that challenge policy. No Yes DISCONTINUE THE ACTIVITY MANAGE THE RESIDUAL RISK Management activities to ensure company activities keep risks under control. Final Report page 43 of 54

44 What does each box mean? 1. Doing Planned Reviews: This is a management function. Here you would be conducting what ever reviews you need to do that will provide the data needed to monitor your operations or new project designs. Here is the database for your safety and loss management system. It would include incident investigations, insurance company reviews, regulatory activities (pressure vessel inspections, environmental reporting, asset renewal needs, changes to laws, code updates, etc.). Not to mention the regular data you collect on your business operations and maintenance activities. The point is you want to be proactive so gathering the data and doing trend analyses in conjunction with statistical analyses will keep you ahead of trouble. 2. Identification of Hazards: One of the outcomes of doing the reviews you mandate as a management team as well as listening to industry activities in general through associations and the news, will be the identification of hazards (or for a better term concerns). Your management team will receive the data and in the wisdom of the team will determine what needs to be further analyzed through doing a risk analysis or analyses. You may wish to do formal reviews of projects for hazards and this is where a Hazard and Operability Study (HazOp) will come into play. Other tools are available but for the processing industries HazOp s are well thought of. A HazOp can be done on an existing process as well. It should be noted that legally a hazard analysis is required and once a hazard is identified action to correct the hazard and communicate the concerns is required under the provincial OH&S Act requirements. This emphasizes the need for effective due diligence by all companies. 3. / Analysis: There are many tools available to help do the risk assessment. There are many tools available to quantify the consequences of all kinds of hazards. Explosions, toxic cloud dispersion models, toxic exposures, lethality, noise, water pollution plumes, etc. etc. All these provide the accurate consequence data you would need to make the right choices. Probability specifically pertains to the failure of systems, humans, equipment, etc. Data is available generically but the best data is in the company s own database with respect to maintenance records and operational records. Probability (frequency) is also quantifiable. 4. Is the Risk Acceptable? In order to enjoy the standard of living we as a society would like to have we need to be aware there is a certain amount of risk associated with that. To this end globally, it has been determined it is okay to expose an individual to one chance in a million (1 X 10 6 ) of a fatality on an annual basis due to an industrial activity nearby. For more detail on this see Appendix 6 and the MIACC criteria (Major Industrial Accidents Council of Canada). Most company management have developed a risk matrix to describe and communicate company policy. The matrix is used to describe what is a low (acceptable) level risk, medium (acceptable with certain conditions) level risk and high (unacceptable) level risk. These matrices clarify to employees what they must do and what is acceptable. The low level risks are usually acceptable without any further management involvement or design additions. Medium risk is the one where management needs to be involved to ensure the risk is kept under Final Report page 44 of 54

45 control and it is worthwhile noting here management s responsibilities come to the front line as they are assuming the responsibility for taking the risk. 5. Manage the Residual Risk: Once a risk is determined to be acceptable it must be managed. This is the largest box in the process as you now have the responsibility for assuming the risk and preventing any incident from happening. This is outlined further in the Process Safety Management systems, which are found around the world as the accepted methods for managing risks. These consist of management elements that must be carried out to manage the risks in an acceptable way. Don t forget that once a risk is accepted it does not go away. It is there waiting for an opportunity to happen unless your management systems are actively monitoring your operation for concerns and take proactive actions to correct potential problems. 6. Can the Risk be Reduced? Often there are ways to reduce the risk once a risk is determined to be unacceptable. The term Inherently Safe implies methods, which will eliminate or reduce the risk. Further controls, management systems, protective features, etc. can be added to reduce the risk to an acceptable level. 7. Reduce the Risk: If the proposed change is viable then do the necessary changes. Note that once the change is made the process is once again used to evaluate for possible new hazards and risks. Changes in processes often create potential problems upstream or downstream. If they are not uncovered your operational risk may go up unknowingly to yourselves. 8. Discontinue the Activity: A very important step is to recognize the risk is too high. Management needs to be clear on this one and make the right decisions. Company values, objectives, etc. all come to play in this box including the idea of lost profits, personal promotions, professional defeat, etc. This statement is a key one because it says you will not do something that is unsafe, pollutes, damages assets, risks your business needlessly, or impacts the public s view of you negatively. Also, your employees are watching your performance and their support for your management decisions is something you need. There is a psychological component to this too. People will not easily admit defeat when trying to do their jobs. Unless management says and demonstrates that it is okay to stop people will continue to try and succeed which often leads to taking unacceptable risks. Final Report page 45 of 54

46 Appendix 2 MIACC Acceptable Level of Risk Criteria Final Report page 46 of 54

47 ACCEPTABLE LEVEL OF RISK CRITERIA (MIACC): Figure 9: MIACC Acceptable Level of Risk Criteria The MIACC Risk Acceptability Criteria describes the level of risk for a member of the public who is inadvertently exposed to an industrial incident must be better than a 1 x 10 6 chance of a fatality. However as the risk contour moves towards the source of the risk the risk level increases understandably. But note that this risk cannot be higher than 1 x 10 4 of a fatality. With this in mind special focus on the workplace is needed to further lessen the exposure potential for workers. This acceptable risk criteria is Canada's approach to a global consensus around industrial risks and land use planning. The concept is developed from a legal conclusion that from a public point of view it is acceptable to have an individual exposed to one chance in a million of being fataly injured over a one year time frame. With this information through the consensus organization called the Major Industrial Accidents Council of Canada the above criteria was agreed on. The type of activity along with the exposure level and density of people all play a part in the determination of the acceptable level for Canada. This is completely in line with the rest of the industrial world. Final Report page 47 of 54

48 Appendix 3 Maps of the Area Final Report page 48 of 54

49 Figure 10: Site Location: Final Report page 49 of 54

50 Figure 11: Site Tank Farm Layout: Final Report page 50 of 54

51 Figure 12: Proposed Burnaby Terminal Expansion: Final Report page 51 of 54