[Client]

13.1.1 According to Clause 3.4.9 of the EIA Study Brief ESB-110/2003 [35] for HKLR (previously named the HZMB – HK Section and North Lantau Highway Connection), a hazard-to-life assessment has to be conducted for the following cases:

· Potential risk to workers during construction stage and to the travelers using the Project during operation due to the aviation fuel storage at Chek Lap Kok Airport.

· If there is overnight storage of explosives on construction site and the storage location is in close proximity to populated areas and/or Potentially Hazardous Installation site(s).

13.1.2 According to the latest design, it is not anticipated that blasting work will be required during construction of the highway including the tunnel through Scenic Hill. Even if blasting is required, there will be no overnight storage of explosives on-site. Therefore no explosives QRA is required.

13.1.3 Project Background

13.1.3.1 The Airport Fuel Tank Farm (AFTF) comprises nine original tanks (six large and three small), with an additional three large tanks which were constructed at a later date to meet the growth in demand anticipated by the Airport Authority Hong Kong (AAHK). The layout of the tank farm is shown in Figure 13.1. The minimum distance between the road and a fuel tank will be around 100m. On the viaduct section of the proposed HKLR near the AFTF, the highway elevation is similar to the tops of the tanks. The alignment and elevations of the proposed HKLR are shown in Figure 13.2.

13.1.3.2 The road of the proposed HKLR to the west of AFTF is still an elevated viaduct, but enters into a tunnel on the side of Scenic Hill. This minimises the risk to the road users on that section.

13.1.3.3 In the tank farm, the tanks all contain Jet A1 fuel and are supplied primarily by pipeline. Currently this is supplied from the aviation fuel receiving facility (AFRF) at Sha Chau, but in the future will be supplied from the Permanent Aviation Fuel Facility (PAFF) in Tuen Mun Area 38.

13.1.3.4 Special reference has been made to the revised Hazard to Life Assessment for the PAFF [3], following the Judgement of the Court of Final Appeal [4] quashing the Environmental Permit (EP-139/2002) granted on the basis of the original Hazard to Life Assessment and other parts of the Environmental Impact Assessment previously submitted for the PAFF.

13.1.3.5 The dimensions of the three different tank sizes are given in Table 13-1. The total fuel tank capacity at the existing facility (i.e. the six large and three small tanks) is 178,989m³, with the three new extension tanks to provide an additional 54,474m³. In 2007, the existing tank farm facility had an annual throughput of 6,140,614m³, with a maximum flow rate of 3,939m³hr^-1. During operation it is expected that the tanks are either full or half full, with approximately 80% of operational time spent at full capacity, and the remaining 20% of operational time spent at half capacity.

Table 13-1 Dimensions of Tanks at Airport Fuel Tank Farm

Tank	Diameter (m)	Height (m)	Capacity (m³)
Existing facility – Small tank	27.5	20.0	11,879
Existing facility – Large tank	39.0	20.0	23,892
New extension facility – Tank	34.0	20.0	18,158

13.1.3.6 The only hazardous substance which is to be stored at the tank farm is Jet A1 aviation fuel. Jet A1 is a Class 2 product according to the Hong Kong Code of Practice for Oil Installations [14]. Class 2 products are defined as having a flash point of or exceeding 23°C, but not exceeding 60°C. Jet A1 is a flammable liquid with a flash point greater than 38°C. The maximum and minimum recorded temperatures in Hong Kong usually range between approximately 36°C and 0°C [3]. This means that Jet A1 will not produce a flammable vapour at ambient temperatures in Hong Kong, even on hotter days. The physical and chemical properties of Jet A1 are given in Table 13-2 below.

Table 13-2 Properties for Jet A1

Property	Value
Liquid density	775-820 kgm^-3 @15°C [6] 840 kgm^-3 [7]
Boiling Point	150°C Initial [6]
Minimum Flash Point	38°C (40°C Test) [6]
Flammable Limits	1-6% vol [6]
Burning Rate	0.053 kgm^-2s^-1 [8]
Pool rate of flame spread	<0.5 ms^-1 [6]
Auto-ignition Temperature	220°C¹ [6]
Minimum ignition energy	0.2mJ [6]
Vapour pressure	<0.1 kPa @ 20°C kPa [6]
Viscosity	1.4x10^‑3 kgm^‑1s^‑1 [6]
Latent heat of vaporisation	291 kJkg^-1 (based on kerosene Table C.1 of [9])
Specific heat	2.19 kJkg^-1K^-1 (based on n-decane Table C.2 of [9])
1. Under less ideal circumstances, the auto-ignition temperature may be substantially higher than 220°C. HSL have measured auto-ignition temperatures of 690°C and 540°C for tests using sprays of Jet A1 onto heated surfaces [6], but Jet A1 has also been ignited when sprayed onto hot engines with probable maximum temperatures of 420°C [6]. In many circumstances, surface temperatures much higher than 220°C may therefore be required to ignite Jet A1.

13.1.3.7 The bund arrangements for the existing and new extension facilities at the Airport Fuel Tank Farm are both of a similar format, comprising of an inner bund wall (1.5m in height at existing and 3.5m in height at new extension), positioned at a (minimum) distance of 10m from the tanks. A secondary outer bund/security fence (2m in height at existing and 5m in height at new extension) is provided, 12m from the primary bund wall, at the existing facility and 8.5m from the primary bund at the new extension facility. 4m from the outer bund is a security fence, beyond the security fence the ground slopes up forming a small natural bund. There is also a drainage ditch near the security fences. Figure 13.3 and Figure 13.4, show a cross section of the arrangements for both the existing and new extension facilities.

13.1.4 Quantitative Risk Assessment

13.1.4.1 In undertaking the risk assessment, a cautious best estimate approach has been applied, as in the PAFF assessment. The cautious best estimate approach ensures that every attempt is made to use realistic best estimate assumptions, but where there is difficulty in justifying an assumption (for example, due to lack of appropriate data) a pessimistic approach is used. A cautious best estimate is cited as the approach used by the UK HSE in the report “Risk criteria for land-use planning in the vicinity of major industrial hazards” [15] (specifically paragraph 26). This approach is widely used in QRA and is consistent with Section 4.4.3 of the Technical Memorandum [10] which says:

When evaluating the residual environmental impacts (the net impacts with the mitigation measures in place), the following factors shall be considered: ...

(x) both the likelihood and degree of uncertainty of adverse environmental impacts: If the adverse environmental impacts are uncertain, they shall be treated more cautiously than impacts for which the effects are certain and the precautionary principle shall apply.

13.1.5 Populations

13.1.5.1 The population area used is based on the route of the highway, outside of the tunnel. Figure 13.5 indicates the section of road this applies to, having a length of ~950m.

13.1.5.2 There are two populations to be considered, during construction and during operation. For the operation phase, the following assumptions are made:

(1) At peak times of the day, the road is likely to be busy. For vehicles moving at speed, a two second gap between vehicles is assumed. Considering variations in speed, an average of 50m between vehicles is considered as a reasonable estimate.

(2) The traffic forecast shows that cars are the commonst vehicles type among likely road users and it is assumed that each vehicle contains two people.

13.1.5.3 Therefore, based on one car containing 2 people per 50m section of lane, with six lanes gives 228 people (i.e. 2x6x950/50), on the 950m of highway shown outside the tunnel. This covers uncertainties such as people per vehicle, type of vehicle (car, coach, lorry) and traffic density. For construction, it is estimated the number of people present will be lower, but of a similar order of magnitude, so this is set at 100 people. These populations will be spread evenly over the full area.

13.1.5.4 The marked population area ends at its east end at the entrance to the tunnel section of the road. There are a number of factors relating to the safety of the tunnel, as follows.

· Because it is raised from ground level, there is no danger of fuel spills from the AFTF entering the tunnel.

· Heat/radiation from pool fire spills is unlikely to cause danger within the tunnel in the time frame of people escaping the area.

· The ventilation system for the tunnel is designed to take air in at its east end, and expel it at the west end (the end near the tank farm, so any smoke from pool fires will not be drawn into tunnel.

In view of the above, the tunnel is assumed to provide adequate protection from all likely events.

13.1.5.5 For the operational phase, the population area has the same width as the road. For the construction worker population, the area used was expanded to 30m either side of the edge of the road to account for the likely spread of people.

13.1.5.6 The above assessment of 228 people as the population for the operational phase is a quantified estimate of what that population is most likely to be. There are however limited conceivable scenarios where there could be a greater number of people present on the section of road under consideration. Such a scenario would entail a number of fully occupied coaches being present and/or heavy traffic congestion/queuing.

13.1.5.7 According to the proportion of different vehicles in the traffic forecast, the average length of a vehicle on the road is about 9.5m. Therefore in stationary traffic, an average of 5.3 vehicles could fit in the 50m section of lane considered per vehicle above. Taking a very conservative approach, and to account for the possibility of a coach full of people, a sensitivity case is included in the modelling where the population is assumed as ten times higher (i.e. 2280 people). It should be noted that this is much higher than the original estimated likely population.

13.1.5.8 The population stated on the road applies to the visible section on the plan (approx 950m). This population is spread out along the road. A pool fire may impact a section of the road. If, for example it impacts along 200m of the road then the impacted population will be 200/950 = 21% of the total assumed.

13.1.5.9 When considering the other already existing roads in the area, populations were calculated by following the same methodology as that explained above for the Hong Kong Link Road.

13.2 EIA Study Brief Requirements for the Assessment

13.2.1 An Environmental Impact Assessment Study Brief (No. ESB-110/2003) [35] has been issued for the Hong Kong Link Road development. The requirements for the Hazard to Life assessment are stated in section 3.4.9 of the study brief and are as follow:

“3.4.9 Hazard to Life

3.4.9.1 The Applicant shall follow the criteria and guidelines for evaluating hazard to life as stated in Annexes 4 and 22 of the TM [10] in conducting hazard assessments for the potential risk to workers during the construction stage and to the travellers using the Project during operation due to the aviation fuel storage at Chek Lap Kok Airport. The hazard assessment shall include the following:

(i) Identification of all credible hazardous scenarios associated with the aviation fuel storage at Chek Lap Kok Airport, which may cause fatalities on the Project during construction and operational phases;

(ii) Execution of a Quantitative Risk Assessment to determine risks to the surrounding population in both the individual and societal terms during the construction and operational phases of the project;

(iii) Comparison of individual and societal risks with the Criteria for Evaluating Hazard to Life stipulated in Annex 4 of the TM [10], to determine the acceptability of the assessed risk;

(iv) Identification and assessment of practicable and cost effective risk mitigation measures to demonstrate the compliance with the Risk Guidelines during construction and operational phases of the Project; and

(v) The methodology of hazard assessment shall be agreed with the Director taking into account relevant previous studies (e.g. the chapter of “Hazard to Life” in the EIA Report for the “Tung Chung – Ngong Ping Cable Car Project” – Register No. AEIAR-074/2003).”

13.2.2 As identified in (v) above, the methodology needs to be agreed with the Director taking into account relevant previous studies. This report summarises the methodology to be applied in the Hazard to Life assessment for review and agreement by the Director.

13.2.3 Note that the methodology for this assessment has been based upon that applied to the PAFF assessment [3] rather than the Tung Chung Cable Car assessment [11]. The PAFF assessment post-dates the Tung Chung Cable Car assessment, considers the risks from Jet A1 tanks in more detail and was undertaken after, and in response to, the findings of the Judicial Review [4]. The Tung Chung Cable Car assessment was also reviewed, and relevant information incorporated, as part of the PAFF assessment.

13.2.4 It is recognised however that there are site features which differ between the PAFF and the AFTF, and these have been taken into account when considering the methodology to follow. The methodology adopted is discussed in the following section, with emphasis placed on how the requirements of the Study Brief (ESB-110/2003) are met.

13.3 Hazard Identification

13.3.1 The potential hazardous scenarios associated with the Airport Fuel Tank Farm that could impact on the Hong Kong Link Road during the construction or operation phases are identified with reference to the PAFF Hazard to Life Assessment [3]. In addition, international guidance on risk assessments including the Dutch Purple Book [12] and the UK HSE’s Safety Report Assessment Guides (SRAGs) [13] are utilised. Note however that these were already incorporated in the hazard identification for the PAFF.

13.3.2 Jet A1 (which is to be stored at the Airport Fuel Tank Farm) is a “Class 2” product as defined by the Hong Kong Code of Practice for Oil Installations [14]. Therefore, the identification of any potential hazards is influenced by the known level of risks usually associated with this classification of fuel.

13.3.3 The majority of the hazardous scenarios listed in “Tank Farm Storage” section of Table 10.2 of the PAFF Hazard to Life Assessment [3] are applicable to the Hong Kong Link Road assessment. This has been reviewed and Table 13-3 below lists the potential hazardous scenarios at the AFTF which could potentially impact the Hong Kong Link Road.

Table 13-3 Potential Hazardous Scenarios for the Hong Kong Link Road Assessment

ID	Scenario
T1	Fire due to discharge from tank vent.
T2	Tank head fire/explosion in tank head space.
T3	Multiple tank head fires.
T4	Tank failure due to overpressure.
T5	Explosion in empty tank (under maintenance).
T6	Bund fire.
T7	Fire outside bund due to rupture/leak of pumps, pipework and fittings.
T8	Fire due to instantaneous tank wall failure, subdivided as follows: · T8As Instantaneous release from bottom seam failure with tank 100% full. · T8Bs Instantaneous release from bottom seam failure with tank 50% full. · T8Az Instantaneous release from tank unzipping with tank 100% full. · T8Bz Instantaneous release from tank unzipping with tank 50% full. · T8Aa Instantaneous release due to aircraft impact with tank100% full. · T8Ba Instantaneous release due to aircraft impact with tank 50% full.
T9	Fire due to multiple tank failure.
T10	Boilover.
T11	Fire due to release from top of tank due to overfilling.
T12	Vapour cloud explosion/flash fire.
T13	Fire due to 10% instantaneous release from the top of a tank.
T14	Fire on sea due to release through drainage

13.3.4 Outcomes of these potential hazard scenarios include tank head fires, bunded pool fires and 100% instantaneous releases leading to bund overtopping and fires outside the bunds. The subdivision to the 100% instantaneous release scenario (T8) is different from that used for the PAFF because the tanks are normally kept at a high level to service the fuel requirement at the airport. Hence, the tanks are considered as either 100% full or 50% full.

13.3.5 It is noted that some release scenarios may lead to pool fire engulfment of the road support columns. However, the concrete structure can be expected to practically retain its integrity for the short duration of bund overtopping fires [31]. As the engulfment of the highway above by such fires will lead to fatalities on the bridge before loss of integrity occurs, then the effect of structural collapse is not considered relevant to the hazard to life assessment.

13.3.6 For the 100% instantaneous release case, the tanks are considered to be full 80% of the time and half full 20% of the time based on information provided by AAHK.

13.4 Scenario Assessment

13.4.1 The AFTF tank farm near to the Hong Kong Link Road stores Jet A1 fuel below its flash point. Under normal conditions, Jet A1 does not form a flammable vapour above its surface and generally poses less of a hazard than the storage of highly flammable liquids, such as gasoline, in similar tanks. The following potentially hazardous scenarios for consideration were identified in Section 13.3:

· T1 Fire due to discharge from tank vent.

· T2 Tank head fire/explosion in tank head space.

· T3 Multiple tank head fires.

· T4 Tank failure due to overpressure.

· T5 Explosion in empty tank (under maintenance).

· T6 Bund fire.

· T7 Fire outside bund due to rupture/leak of pumps, pipework and fittings.

· T8 Fire due to instantaneous tank wall failure, subdivided as follows:

Ø T8As Instantaneous release from bottom seam failure with tank 100% full.

Ø T8Bs Instantaneous release from bottom seam failure with tank 50% full.

Ø T8Az Instantaneous release from tank unzipping with tank 100% full.

Ø T8Bz Instantaneous release from tank unzipping with tank 50% full.

Ø T8Aa Instantaneous release due to aircraft impact with tank100% full.

Ø T8Ba Instantaneous release due to aircraft impact with tank 50% full.

· T9 Fire due to multiple tank failure overflowing bund.

· T10 Boilover.

· T11 Fire due to release from top of tank due to overfilling.

· T12 Vapour cloud explosion/flash fire.

· T13 Fire due to 10% instantaneous release from the top of a tank.

· T14 Fire on sea due to release through drainage.

13.4.2 The risk levels due to each scenario are quantified in the following sections. For some of the potential scenarios, it is concluded that they are either not applicable to the AFTF tanks or fall completely within other scenarios; they have still been included for completeness. This is in line with the identification of hazardous scenarios from previous experience of similar, fixed roof, atmospheric pressure tank farms, many of which stored hazardous substances other than Jet A1.

13.4.3 T1 Fire due to Discharge from Tank Vent

13.4.3.1 Unlike the AFTF tanks, many atmospheric pressure and temperature storage tanks store liquids above their flash point. For these tanks the vapour in the head space of the tank will generally be above the lower flammability limit and, depending on the conditions, may also be above the upper flammability limit. A discharge of this vapour from a tank vent, although in a remote location, could be ignited leading to a tank vent fire.

13.4.3.2 Lightning is a relatively common ignition source for tank fires. For example, there was an incident in 1997 in Hong Kong when a 31,000 tonne tanker was struck by lightning after completion of unloading at one of the fuel terminals in Tsing Yi Island. The fire occurred on the gas vent pipe and was extinguished by Fire Services.

13.4.3.3 Jet A1 in the AFTF tanks is stored below its flash point (see Jet A1 properties in Section 13.1.3, Table 13-2) so any vapour discharged from the vents will be below its lower flammability limit and will therefore not pose a fire hazard. The frequency of the event is therefore quantified as zero for the AFTF and, if a vent fire were to occur, the consequences also amount to zero fatalities on the Hong Kong Link Road.

13.4.4 T2 Tank Head Fire/Explosion in Tank Head Space

13.4.4.1 One of the hazards of atmospheric pressure fuel storage in tanks is the failure of the roof and ignition of the fuel surface, leading to a tank head fire. The tank may buckle above the liquid level due to exposure to the flame, but the liquid provides cooling to the tank shell below the liquid surface level so that distortion here is minimal and failure below the liquid level is not an issue.

13.4.4.2 Tank head fires can be initiated by the presence of an ignition source, with a flammable vapour present in the tank ullage space. This would be expected to fail the weak tank roof to wall seal, exposing the surface of the fuel. Potential ignition sources of concern include lightning strike, static electricity, hot work, and instrument electrical faults. Under normal operation there will be no ignition sources present at the tank top level. All the mechanical and electrical installations within the tanks are rated for operation in flammable atmospheres, and the bulk vapour in the tank will not be within the flammable range. It is possible for localised areas to exceed the lower flammability limit within the tank head space, even for Jet A1 under ambient Hong Kong conditions, because the tank roof may be heated by sunlight and exceed the flash point of Jet A1. However, this is only a localised effect and the bulk vapour space in the tank would not be in the flammable range. Therefore it could not lead to a significant overpressure being generated, even if it was ignited. Similarly, the energy generated would be very unlikely to ignite the bulk liquid.

13.4.4.3 Lees ([16], Paragraph A14.23.5) provides an estimate for the frequency of a fire or explosion in a fixed roof hydrocarbon storage tank of 1.2x10^-3/yr based on a review of over 500 fixed roof hydrocarbon tanks over a 20 year period by Kletz. A reduction factor of 10 is estimated where inerting is used ([16], Paragraph A14.23.5). Although the Airport Fuel Tank Farm tanks will not be specifically inerted, the Jet A1 will be stored below its flash point. This will have a similar effect in reducing the chances of ignition, and is therefore adopted here, giving a tank head fire frequency of 1.2x10^-4/yr per tank. For the existing nine tanks at the Airport Fuel Tank Farm, the total tank head fire frequency is 1.1x10^-3/yr. With the additional three new extension tanks at the facility this frequency will increase to 1.4x10^-3/yr.

13.4.4.4 Tank head fires have been modelled for the large and small tanks at the existing facility and for the tanks at the new extension. These are modelled as a pool fire of the same diameter as the tank, 28m above ground level (i.e. the height of the tank). Thermal radiation levels at ground level are not predicted to lead to fatalities outside the tank area, so no off-site fatalities at ground level of the Hong Kong Link Road are predicted.

13.4.4.5 Simple heat transfer modelling for the roof of an adjacent tank indicates that the roof is unlikely to fail directly even under the maximum thermal flux of 10kWm^-2 predicted inside the flame envelope. However, the metal may exceed the auto-ignition temperature of Jet A1 with thermal fluxes ~5kWm^-2 over a significant area of the roof. The storage tanks have at least a 15m separation, but a thermal flux in excess of 5kWm^-2 may occur at roof level with the wind blowing directly from one tank to another. In these conditions, an adjacent tank roof may potentially also be set on fire if the tank roof and shell are not cooled by the tank spray cooling system or fire service intervention. However, some time will be required to heat the Jet A1 sufficiently to form a flammable mixture adjacent to the heated roof and so escalation from a tank head fire is not expected immediately.

13.4.4.6 For a large tank at the existing facility, to heat a 1m height of Jet A1 by 1°C requires a heat input of about 2190Jkg^-1K^-1 x 840kgm^-3 x p(39m)²/4 x 1m = 2.2GJ. Over the corresponding heating area, this requires a heat input of 2.2GJ/(p x 39m x 1m) = 18 MJm^-2, with a mean net thermal flux of 5kWm^-2 all around the tank, this would require 1 hour. Even on one of the hottest days of the year (with a maximum temperature of 33°C or more), the heat-up of the Jet A1 liquid to above it’s flash point will take several hours and at more typical temperatures, may take of order one day. This allows ample time for evacuation of surrounding areas. Therefore the escalation of tank head fires to multiple tank head fires is not considered to be likely, in a time that would affect the impact on personnel escaping from the initial event.

13.4.4.7 Table 13-4 gives a summary of the PFIRE results for the three types of tank present in the AFTF, whilst Figure 13.6 provides a diagrammatical explanation of the values quoted.

Table 13-4 Pool Fire Results for Tanks on Hong Kong Link Road Side

TANK Type	Tank of this type nearest to Link Road	Distance from Link Road (m)	Tank Diameter (m)	POOL FIRE RESULTS
				*Wind Speed = 2ms^-1*			*Wind Speed = 5ms^-1*			*Wind Speed = 10ms^-1*
				Flame Drag, L_f (m)	Max. height of smoke above tank, H_s (m)	Max. Down- wind distance of smoke cloud, L_s (m)	Flame Drag, L_f (m)	Max. height of smoke above tank, H_s(m)	Max. Down- wind distance of smoke cloud, L_s (m)	Flame Drag, L_f (m)	Max. height of smoke above tank, H_s (m)	Max. Down- wind distance of smoke cloud, L_s (m)
Existing Small	T-11-008	180	27.5	3.3	26.4	20.0	7.5	21.0	31.0	11.0	16.7	37.4
Existing Large	T-11-006	160	39.0	3.7	34.5	23.6	9.5	27.9	37.9	14.3	22.4	47.2
New extension	T-11-020	107	34.0	3.6	31.0	22.2	8.7	25.0	35.0	12.9	20.0	43.1

13.4.4.8 The flame from a tank head fire will be exposed above the rim of the tank travelling a maximum downwind distance of 14m in a 10ms^-1 wind for the “Existing Large” tank type. The largest size downwind smoke cloud size of 47m also occurs with this tank type. The distance between the tanks and the highway is greater than 100m for all tanks, and in may cases is significantly more.

13.4.4.9 The thermal radiation would provide only a local hazard a few metres from the flame [3]. The thermal flux levels and effects this could generate are discussed in Appendix 13C. A tank head fire would not be expected to cause any significant off-site risk to life, although precautionary evacuation of the surrounding area would be recommended to reduce the exposure of off-site populations to any subsequent escalation of the incident. The number of off-site fatalities at the Hong Kong Link Road both at elevation and on the ground, for this scenario, is therefore quantified as zero.

13.4.5 T3 Multiple Tank Head Fires

13.4.5.1 A tank head fire has the potential to impact an adjacent tank, which may result in an adjacent tank fire. It is possible for such fires to spread from tank to tank leading to many or all of the tanks in a bund, or the adjacent bund, catching fire.

13.4.5.2 As for the PAFF, for the tank separation distances at the AFTF it is estimated that tank to tank escalation could occur if there is a wind blowing directly from one tank to another. However, it would be expected to take many hours allowing ample time for evacuation of the surrounding areas. Based on a review of the tank farm layout and wind direction information available, this is expected to occur at most 50% of the time.

13.4.5.3 However, the storage tanks have a spray cooling system installed and the adjacent tanks (in the sector opposite the tank on fire) will be cooled in the event of a tank fire. As a cautious estimate, the failure probability of tank cooling is taken as 10% with the fixed system installed. Typically, such systems would be expected to be at least this reliable.

13.4.5.4 An overall estimate of the multiple tank head fire frequency is therefore taken as 5% of the individual tank head fire frequency (see Section 13.4.4). This gives 5.5x10^-5 /yr for the existing nine tanks, and 7.0x10^-5 /yr when the three tanks of the new extension area are included.

13.4.5.5 A multiple tank head fire could also be initiated by a prolonged bund fire around the tank. However this is not considered as a separate scenario, since the hazard to life is dominated by the thermal radiation from the larger bund fire at ground level.

13.4.5.6 27 multiple tank fire incidents are listed by McBride [28] up to 2002. Eight of the incidents, which also involved explosions or fires starting outside tank bunded areas, involved fatalities. A recent major incident also occurred at Buncefield in the UK, described as follows “At around 06.00 on Sunday 11 December 2005, a number of explosions occurred at Buncefield Oil Storage Depot, Hemel Hempstead, Hertfordshire. At least one of the initial explosions was of massive proportions and there was a large fire, which engulfed over 20 large fuel storage tanks over a high proportion of the site. There were 43 people injured in the incident, none seriously. There were no fatalities.” [29].

13.4.5.7 Owing to the time available for evacuation prior to the establishment of a multiple tank head fire scenario at the AFTF, the hazard to life from this scenario is considered minimal compared to that from the initial tank head fire or external fire that initiated the incident. The thermal radiation levels adjacent to any single tank would be slightly increased by the additional heat flux from adjacent fires, but the number of off-site fatalities for this scenario is still quantified as zero for the Hong Kong Link Road.

13.4.6 T4 Tank Failure due to Overpressure

13.4.6.1 The AFTF tanks are of an open vented design including at least one redundant vent. The tanks will also be provided with a weak shell to roof connection (specified in API 650) that is designed to fail in the event of an overpressure within the tank. Apart from during filling, there is nothing to lead to an overpressure inside the tanks, except an explosion.

13.4.6.2 An overpressure within the tanks would be discharged by the tank vents or the weak shell to roof seam and would not be expected to have any offsite consequences. The frequency of this event is therefore assessed as zero, leading to zero fatalities on the Hong Kong Link Road. Overfilling and vapour space explosions are considered separately.

13.4.7 T5 Explosion in Empty Tank (Under Maintenance)

13.4.7.1 Explosions have occurred in nominally empty tanks during maintenance work, particularly during hot work. Small quantities of Jet A1 could be present after the tank has been initially cleaned and could potentially be ignited. Procedures are in place to avoid such an incident occurring during confined space entry and Jet A1, being below its flash point could generate only a very small quantity of flammable vapour close to the source of heat. The explosion overpressures produced if this were ignited would be small. Even allowing for a flammable volume of several cubic metres, ignition in a 33,500m³ tank (the largest AFTF tank) would generate an overpressure of less than 1mb [3], which would be too low to cause any damage to the tank structure or the weak shell to roof joint. Although injuries/fatalities could occur to workers in the immediate area inside the tank, there would be no damage outside the tank and no possibility of off-site fatalities as a result. This scenario is therefore assessed as having a zero frequency for producing Hong Kong Link Road fatalities.

13.4.8 T6 Bund Fire

13.4.8.1 The AFTF tanks (existing and new extension) are contained in two separate bunds spaced approximately 40m apart. The nine tanks at the existing facility are contained by a primary bund and a secondary wall/security fence arrangement. The three new extension tanks will be contained within a similar bunding arrangement, but the dimensions and separations between the walls will be slightly different (see Section 13.1.3). In the existing development the bund volume is capable of holding up to 175% of the capacity of the largest tank (20m fill level). For the new extension development, the bund capacity will be 216% of the largest tank (fill level of 20m). In both cases this provides a significant margin over the conventional 110% of tank contents, which is the accepted norm internationally (100% under Hong Kong code of practice on oil installations [14]), therefore a release outside of the bund from a pipework or tank leak is unlikely.

13.4.8.2 Davies et al [17] suggests a bund fire frequency in a common bund of 1.2x10^-5/yr for a flammable liquid. This frequency includes all causes such as tank failure, overfilling, pipework failure, external fire impact on equipment, etc. The bund fire frequency for the Airport Fuel Tank Farm facility is therefore predicted as 1.2x10^-5/yr per bund (existing/new extension). Bund fires may occur following catastrophic release of liquid from a tank, overfilling or piping failure and subsequent ignition of the material. All of these causes are included within this frequency.

13.4.8.3 The bund at the existing facility has an area of between 19,000 and 28,000 m², depending on whether the tank areas themselves are included. For indicative calculations, we approximate the pool area as ~23,500m², giving an equivalent pool diameter of 170m.

13.4.8.4 At the new extension facility the bund has an area of between 8,600 and 5,600 m², depending on whether the tank areas themselves are included. For indicative calculations, we approximate the pool area as ~7,100m², giving an equivalent pool diameter of 96m.

13.4.8.5 To assess the impacts of a bund fire it is necessary to consider the two scenarios that may apply. Users of the highway will be travelling by car and would therefore be able to pass a bund fire at the AFTF in a very short time of less than 10 seconds (Appendix 13C). This scenario is assumed to be the case for 90% of the highway’s operational time. An alternative scenario is the occurrence of traffic congestion on the highway. In this case users would be “trapped” on the highway. This scenario accounts for the remaining 10% of the highway’s operational time. When “trapped” it is likely that the highway users would vacate their cars and escape the bridge on foot. This would increase their exposure time to a bund fire to a maximum of 85 seconds (see Appendix 13C).

13.4.8.6 In Appendix 13C it is shown that it is only for the longer exposure time (when a person has to vacate the highway by foot) that the effects of thermal radiation outside the flame/smoke envelope may be of consequence. The dimensions of the flame envelopes for the bund fires are calculated in Appendix 13C, and show that even at wind speeds of up to 10ms^-1 the smoke envelopes do not encroach upon the highway.

13.4.8.7 The probability of fatality is taken as 100% within the predicted flame area and zero outside the predicted flame area. Therefore as the flame area does not encompass the Hong Kong Link Road, even at higher wind speeds, a bund pool fire would result in zero fatalities on the Hong Kong Link Road for a short duration of exposure (i.e. a car passing).

13.4.8.8 In the case of the highway being blocked and escape being on foot, as mentioned previously, it is necessary to consider both the impact of the flame envelope and the effects of thermal radiation. As discussed in Appendix 13C the levels of thermal dose which radiate to the highway from the bund fires falls below what would be considered a lethal level. It should also be noted that a jet fuel fire takes time to develop after ignition and so there is some time before the bund fires develop sufficiently to produce the thermal doses quoted in Appendix 13C. Therefore it is concluded that a bund pool fire would result in zero fatalities on the Hong Kong Link Road for the longer duration of exposure considered (i.e. when traffic is blocked).

13.4.9 T7 Fire outside Bund due to Rupture/Leak of Pumps, Pipework and Fittings

13.4.9.1 This hazard scenario is concerned with tank farm pipework, pumps etc. being responsible for a leak of jet fuel outside of the bund. For example, in the PAFF assessment, a pump platform and associated inventory was outside the tank bunded area, contributing most of the risk for this scenario.

13.4.9.2 For the AFTF all such items are contained within a bunding arrangement. As such, any releases would lead to a bund fire. This would be of a lower magnitude than a tank release, as less fuel would be likely to be involved. Bund fire consequences were addressed in Section 13.4.8, where it was concluded they would not lead to any fatalities on the Hong Kong Link Road. Therefore the number of off-site fatalities at the Hong Kong Link Road both at elevation and on the ground, for this scenario, is quantified as zero.

13.4.10 T8 Fire due to Instantaneous Tank Wall Failure

13.4.10.1 Only instantaneous failures of the AFTF tanks that are sufficiently rapid, where the contents of the tank are released quickly enough to significantly overtop the bund wall, are of concern in this section. Even very large failures, (e.g. a hole of 1m high by 10m wide in the wall of the tank), will not release the contents sufficiently rapidly to result in major bund overtopping [3]. Similarly, failures of connections or associated pipe-work are not relevant for this scenario for the same reason. If ignited, incidents that do not involve major overtopping of the AFTF bunds would result in a bund fire as discussed in Section 13.4.8.

13.4.10.2 The failures of concern in this section are therefore restricted to a sudden unzipping of the tank due to the rapid propagation of a crack, or an incident capable of directly resulting in rapid loss of the tank wall or a major part of it. The three incident scenarios identified for consideration are a bottom seam failure, tank unzipping and aircraft impact.

Event Frequency

13.4.10.3 The methodology applied in the PAFF report for assessing the frequency of an instantaneous release from a tank, involved reviewing all the historical catastrophic failure incidents between 1924 and 1995. In addition, various literature sources were referenced which allowed an upper, lower and cautious best estimate of the instantaneous release frequency for a PAFF tank to be made. As the type of storage tank present at both the PAFF and Airport Fuel Tank Farm will be similar, then the estimates made for the PAFF facility can also be applied in this case. The estimates of instantaneous release frequency for an Airport Fuel Farm tank are given in Table 13-5. The cautious best estimate is used, split equally between bottom seam failures and unzipping, as in the PAFF assessment [3].

Table 13-5 Estimates of Instantaneous Release Frequency for Airport Fuel Farm Tanks

Data Applicable to PAFF tank	Lower Estimate*	Cautious Best Estimate	Upper Estimate*
Tank Population (A) *	6,000,000	2,400,000	2,400,000
Applicable experience years (B) *	77	30	30
Applicable number of incidents (C)	0.1	0.35	2
Instantaneous release frequency per Airport Fuel Farm tank year (C/A/B)	2x10^‑10	5x10^‑9	3x10^‑8
*Note: Lower and upper estimates for tank population and experience years are reversed in the calculation of failure frequency.

13.4.10.4 A review has been undertaken of incidents in the MHIDAS database [37] to supplement the incident review in the PAFF Hazard to Life Assessment. The search considered failures of atmospheric pressure storage tanks since 2000 to date. This produced a total of 284 records covering all sizes and contents of tanks. Two incidents were identified from the record abstracts that could potentially represent instantaneous failures relevant to the AFTF tanks based on the MHIDAS abstract alone. These were:

· Preston, UK, March 2000: A tank ruptured and split, spilling about 2000 litres of diesel which ignited. Fire service extinguished fire although the cause is still under investigation. Tank in open area, with no real danger to personnel. (record 10257)

· Asheville, USA, September 2004: Flood waters caused release of up to 180,000gall kerosene and gasoline from six 30000gall storage tanks at petroleum plant. Release into the Swanannoa river & 20,000galls initially recovered. Tanks were pushed off foundations and failed catastrophically. (record 13124)

13.4.10.5 A study of the original references for each of these revealed:

· The Preston incident was also described as “diesel leaking from a tank” and “firefighters … quickly extinguished the fire using a special foam mixture”. This incident therefore does not appear to be a 100% instantaneous rupture case.

· The Asheville incident involves a series of relatively small tanks (115m³) that were pushed off their foundations into a river due to flood waters. Although the failures were clearly catastrophic the report does not imply a 100% instantaneous release and states “The tanks are currently floating in the river…”. This implies the floated tanks were still essentially intact. These are also small tanks. Tanks of the size of the AFTF tanks would also be much less susceptible to floatation due to floodwaters. This incident is therefore also not relevant to a 100% instantaneous failure of one of the AFTF tanks.

13.4.10.6 It is concluded that there are no specific events reported in the MHIDAS database since 2000 that need to be considered in addition to the incidents considered in the PAFF Hazard to Life Assessment. Although the additional years of experience could be considered in this analysis, the 100% instantaneous failure frequency identified for the PAFF tanks is considered equally applicable to the AFTF tanks and is used directly.

13.4.10.7 No incidents in which an aircraft impact leads to an instantaneous failure of a large tank, or any failure considered as catastrophic, were noted in the review of all the historical catastrophic failure incidents between 1924 and 1995 undertaken for the PAFF assessment. However, the predicted aircraft impact frequency has been separately assessed (see Appendix 13B for full details).

13.4.10.8 Scenarios ID T8Aa and T8Ba, which refer to an instantaneous tank failure caused by an aircraft impact, require that an ‘aircraft impact frequency’ be calculated for the AFTF. A similar calculation was undertaken in the PAFF assessment and the same method has been utilised for this assessment (reviewed and updated in consideration of the Tung Chung cable Car EIA). The aircraft impact frequency calculated using this method and information is 2.8x10^-10/yr per tank. The full calculation can be found in Appendix 13B. Note that a value has been calculated for the frequency in 2040 only, which will be cautious for the construction phase. This is treated separately from the instantaneous failure above (Table 13-5), since the aircraft impact is also assumed to result in immediate ignition of the release.

Liquid Spread

13.4.10.9 To better understand the effects of an instantaneous tank failure, physical modelling was undertaken for the PAFF assessment [3]. Although there are differences between the bunding arrangements at the PAFF facility and the AFTF (existing and new extension) facilities, the physical modelling results have been adapted for use in this current assessment. The experimental results were adapted by using the Thyer et al [20] correlation, for the bund overtopping fraction Q, over vertical bund walls:

Q = 0.044 - 0.264 ln(h/H) - 0.116 ln(r/H)

Where, h is the bund wall height, H is the tank liquid height, and r is the distance from the centre of the tank to the bund wall.

13.4.10.10 In addition, account was taken of the varying heights of the bund walls and the separation between the bund walls, applying a relevant scaling factor where appropriate, for the calculation undertaken (see Appendix 13A for details). The adapted pool spread results from instantaneous tank failure are given in Table 13-6, for instantaneous tank removal and unzipping cases.

Table 13-6 Adapted Pool Spread Results for an Instantaneous Tank Failure

Location		Percentage (%) of Initial Liquid for Test
Location	Case	EXISTING FACILITY		NEW EXTENSION FACILITY
100% Full Tanks		Remove	Unzip	Remove	Unzip
Retained in primary bund		63%	60%	75%	73%
Retained between primary and secondary wall		5%	6%	6%	8%
Fraction of liquid which overtops secondary wall and spreads		32%	34%	19%	19%
50% Full Tanks
Retained in Primary and Secondary Bunds		90%	87%	94%	93%
Amount of liquid which overtops the secondary wall and spreads		10%	13%	6%	7%

13.4.10.11 Taking into account the approximate nature of the overtopping fractions calculated, including differences between instantaneous tank removal and unzipping scenarios, the following values are used for subsequent calculations (rounded up to the nearest 5%):

· 100% Full Tanks

Ø Existing facility: 35%

Ø New extension Facility: 20%

· 50% Full Tanks

Ø Existing Facility: 15%

Ø New extension Facility: 10%

13.4.10.12 Table 13-7, summarises the volumes of the tanks and the area of the subsequent pool which would form outside the boundary arrangements from each tank, given the relevant overtopping fractions in Table 13-6. The spill areas have been estimated based on the assumption that, allowing for the rough areas of ground and changes in elevation, the spill outside the bund would be 20cm deep on average. This is in line with the results of the physical tests conducted for the PAFF tank designs.

Table 13-7 Area of Pool Formed Following a Tank Release Overtopping the Bund

For 100% Full Tanks			Spill Outside Bund
Tanks	Volume (m³)	Q (Overtopping Fraction)	Volume (m³)	Area (m²)
T-11-001/2/3/4/5/6	23892	0.35	8362	41810
T-11-007/8/9	11879	0.35	4158	20790
T-11-018/19/20	18158	0.2	3632	18160
For 50% Full Tanks			Spill Outside Bund
T-11-001/2/3/4/5/6	11946	0.15	1792	8960
T-11-007/8/9	5940	0.15	891	4455
T-11-018/19/20	9079	0.1	908	4540

13.4.10.13 For bund overtopping away from the HK Link Road, a semi-circular approach with a pool of average depth 20cm is taken. This is since no detailed terrain investigation around the tank farm on the sides away from the Link Road has been undertaken, or is relevant to the project. Resulting risk contours on this side of the tank farm, away from the Link Road, will therefore be indicative only.

13.4.10.14 When evaluating the shape of an overtopping pool, account is taken of the potential drainage over the land and road surfaces based on a review of site information. The indicative depth of 20cm is maintained, with due allowance where there is an obvious drainage path that would flow down a slope to the sea. A contour map and photos of the site and surrounding land have been studied to generate predictions of flow area. Flow areas are plotted on a plan to represent the expected pool spreading, taking into account topographical features of the landscape. As the issue of concern is the effect on the Hong Kong Link Road, a conservative approach was taken by favouring spreading towards the highway where possible. Liquid spreading this far is expected to reach the shoreline. Examples are can be seen in Figure 13.7, which shows the pool spread for overtopping releases from tanks T-11-004 (red), T-11-008 (blue) and T-11-020 (green), including the bund areas. These pool shapes are then used in the overall hazard calculations from pool fires.

13.4.10.15 For the releases of concern, the main drainage path is along Scenic Road and the surrounding area towards the sea (bottom of Figure 13.7). The scenic hill to the right forms one boundary to the flow, whilst the land is flatter away from the hill. Details, such as the kerbing down the centre of the scenic road are not considered as significant impediments to the overall flows of the size considered. The major difference in predicted drainage paths is between cases where the flow from the tank is directed across Scenic Road towards Scenic Hill (blue contour from T-11-008) and where the flow is over a flatter general area (red and green contours).

· For flow across Scenic Road towards the hill, the direction of drainage is taken down the road and surroundings only (blue contour).

· For flow directed over a flatter area, or impinging on obstacles (such as the tank farm building) that would spread the flow, the liquid is taken to spread more widely over the available area and flow down the slope to the sea (red contour).

13.4.10.16 Drainage may also occur in the opposite direction along Scenic Road since the crest of the road is adjacent to the tank farm boundary. However, the detailed effects are not assessed because they are away from the Hong Kong Link Road.

13.4.10.17 The most important aspect is that the assessed drainage route for releases of this type will pass beneath the Hong Kong Link Road as it flows down towards the sea. Ignition of such spills will therefore provide for direct fire impingement on the highway above, or construction workers at ground level. Although the precise details of such drainage will always be uncertain, this approach provides a robust assessment of the potential impact on the Hong Kong Link Road.

Ignition Probability

13.4.10.18 Unlike the tank head or bund pool scenarios where the frequencies given in Sections 13.4.4 and 13.4.8 are for the event of a fire, the frequency for the instantaneous tank failure (whether by mechanical failure or caused by aircraft impact) quoted in Table 13-5 does not include the probability of ignition. For the case of an instantaneous tank failure caused by an aircraft impact the probability of ignition is taken to be one, as was done in the PAFF assessment. That is, it is assumed that if an aircraft impacts on the facility causing the instantaneous failure of a tank then the escaped liquid will ignite.

13.4.10.19 To assess the probability of ignition of spills caused by instantaneous failure of a tank through bottom seam failure or unzipping, the same method utilised in the PAFF report is used. This involves using the following equation based on ignition modelling work conducted to UK HSE [19].

P_ign = 1 – exp(-μAp)

13.4.10.20 Where, P_ign is the ignition probability for the spill in the area, μ, is the ignition source density per hectare, A is the area covered by the liquid spill in hectares and p is the ignition probability for each individual ignition source. The values for μ and p can be taken from tables in [19] and referenced in the PAFF report. As for the PAFF assessment, the ignition probability will be reduced by a factor of 10 to account for the difficulty in igniting Jet A1. Two situations need to be considered for a spill from the Airport Fuel Tank Farm:

· During construction of the Hong Kong Link Road there will be a variety of ignition sources associated with the construction activity, including heavy machinery, welding equipment, etc. The ignition probability is based on Machinery (high concentration of heavy equipment, welding, etc.). Based on line 9 of Table C4 [19] this gives μ = 0.14, and p = 0.1.

· Post construction, the Hong Kong Link Road area can be considered to have the same level of risk associated with a rural area with road vehicles during daytime. Based on Table B12 [19] this gives μ = 0.027 and p = 0.01. A daytime value is used over the full day because this road in proximity to an airport where operations take place 24 hours a day. Note that since the highway is elevated and Jet A1 does not produce a flammable vapour under ambient conditions in Hong Kong, vehicle ignition sources on the elevated highway itself are not included.

13.4.10.21 Using these values the probability of ignition (P_ign) can be calculated for a hypothetical spill resulting from the instantaneous failure of any of the tanks at the facility. Note that the area of the pool (A) will be dependent on the size of the tank which has failed. The value calculated for P_ign can then be multiplied by the frequency of an instantaneous tank failure quoted in Table 13-5, to give the frequency of an event occurring which results in the instantaneous failure of a tank and the subsequent ignition of the liquid pool which overtops the secondary bund wall in a given direction. The ignition probabilities for both with and without construction activities are given in the Table 13-8 for each release.

Table 13-8 Ignition Probability of Instantaneous Tank Failure Spill Pools

Tank (100%)	Q	Spill Area (m2)	Ignition Probability
Tank (100%)	Q	Spill Area (m2)	Without cons.	With cons.
T-11-001/2/3/4/5/6	0.35	41810	1.13x10^-3	5.69x10^-2
T-11-007/8/9	0.35	20790	5.61x10^-4	2.87x10^-2
T-11-018/19/20	0.2	18160	4.90x10^-4	2.51x10^-2
Tank (50%)
T-11-001/2/3/4/5/6	0.15	8960	2.42x10^-4	1.25x10^-2
T-11-007/8/9	0.15	4455	1.20x10^-4	6.22x10^-3
T-11-018/19/20	0.1	4540	1.23x10^-4	6.34x10^-3

13.4.10.22 The ignition probabilities of the spill pools can then be combined with the frequency of an instantaneous tank failure from Table 13-5 Estimates of Instantaneous Release Frequency for Airport Fuel Farm Tanks (caused by either a material failure or an aircraft impact) to give the frequency of an instantaneous tank failure resulting in a pool fire. When the proportion of time the tanks spend at each fill level is accounted for (80% full, 20% half full), the frequencies detailed in Table 13-9 result.

Table 13-9 Event Frequency of Instantaneous Tank Failure Spill Pool Fires

EVENT	Event Frequency (/yr)
	Without construction	With construction
Instantaneous material failure (unzipping/seam failure) of tank: 100% full: T-11-001/2/3/4/5/6 resulting in a pool fire T-11-007/8/9 resulting in a pool fire T-11-018/19/20 resulting in a pool fire 50% full: T-11-001/2/3/4/5/6 resulting in a pool fire T-11-007/8/9 resulting in a pool fire T-11-018/19/20 resulting in a pool fire	4.51x10^-12 2.24x10^-12 1.96x10^-12 2.42x10^-13 1.20x10^-13 1.23x10^-13	2.27x10^-10 1.15x10^-10 1.00x10^-10 1.25x10^-11 6.22x10^-12 6.34x10^-12
Aircraft impact resulting in a pool fire of the spill	2.8x10^-10/tank (2040)

13.4.10.23 It may be noted that in the operational life of the highway (i.e. the without construction case) aircraft impact dominates.

Summary

13.4.10.24 It is clear from the adapted pool spread experimental results (Table 13-6), that although the majority of liquid would be contained at either the primary or secondary bund, some liquid would spill over the secondary bund wall, following an instantaneous tank failure. It has been assumed that this overtopping liquid would spread out forming a pool 20cm deep, with shape dependent on the contours of the ground. In some cases, these pools would spread far enough as to encompass the highway, potentially causing a risk to the highway users. However, as can be seen from the event frequencies (Table 13-9) the likelihood of an instantaneous failure of a tank, resulting in a pool fire, is somewhere in the order of magnitude of 10^-10 to 10^-13 per year (an extremely unlikely event).

13.4.11 T9 Fire due to Multiple Tank Failure Overflowing Bund

13.4.11.1 It would, in theory, be possible for more than one tank to release its contents into the bund at the same time, possibly leading to overflow if the bund capacity is exceeded. In the existing farm of nine tanks, the primary bund can retain 146% of the capacity of the larger tank size (293% of the smaller tank size). When the secondary bunding is taken into consideration, the whole bunding arrangement can contain 175% of the capacity of the largest tank size (352% of the smaller tank size). For the new extension farm of three tanks (where all tanks are the same size), the equivalent numbers are 140% for the primary bund and 216% including the secondary bund.

13.4.11.2 For the new extension bund, a release from two tanks would lead to a similar situation as the release from one tank, the consequences of which are covered by the bund fire scenario. It would require the release of the contents of all three full tanks for the secondary bund capacity to be exceeded. In the case of the existing bund, a release from two or more full tanks of the larger size would exceed the capacity.

13.4.11.3 For the capacity exceedance scenario to occur, tank failures must occur over the same time frame, rather than failures occurring late in a fire incident due to fire impingement after much fuel has been burned off. Also tanks are not expected to fail below the liquid level under external fire attack, due to the cooling effect of the liquid.

13.4.11.4 A large release from a tank is estimated to have a frequency of 4.5x10^-4 /yr [32]. For the existing tank farm of nine tanks an independent release from 2 of the tanks (within ~3 days so the release may not have been cleaned up or burnt out) would have a frequency of 9x4.5x10^-4x8x4.5x10^-4x3/365 = 1x10^-7/yr (this is a conservative estimate as it does not take into account that three of the tanks are smaller and also does not allow for evacuation over the three day period assumed).

13.4.11.5 The bund has an area of 2.75ha. Ignition probability evaluation was described in Section 13.4.10. Ignition sources within the bund area will be minimised, so the post construction equation parameters (i.e. lower values) will be used. This gives an ignition probability of 7.4x10^-4, leading to a bund fire frequency of 7x10^-11/yr involving independent releases from 2 tanks. For 3 out of 12 tanks failing independently, this reduces to 2x10^-13/yr.

13.4.11.6 Following similar steps for the new extension tank farm (area of 1.39ha), the frequency of a fire from all 3 tanks failing independently is nominally 1.7x10^-15/yr. Given the low event frequencies for both tank farms, it is clear that multiple independent failures of the tanks will not dominate the frequency of this scenario.

13.4.11.7 The most credible means would be a large release from the connecting pipes while tank valves are open. This is unlikely, since the valves on tanks not receiving or delivering product would normally be closed and, whilst failure to close an open valve may be reasonably common (taken conservatively as 0.1 per demand), the spurious opening of a closed valve is much less common (taken conservatively as 0.01).

13.4.11.8 For the PAFF, a facility containing 12 tanks, split into 6 tanks in two connected bunds, the frequency of a large release from the pipe-work in one of the bunds was estimated to be 3.2x10^-2/yr. Considering the size difference, this is multiplied by 0.5 to give a frequency of 1.6x10^-2/yr. Also required to calculate the overall event frequency are the following, evaluated for the new extension bund:

· The probability of failure to isolate the on-line tank valve would be estimated as 0.1, as above.

· The frequency of an additional valve spuriously opening is based on a frequency of critical spurious valve operation of 0.61 per million hours given in Oreda 2002 (taxonomy 4.3 [36]). For a nominal 3 day period, the probability is estimated as 4.4x10^-5 per valve. Given that this would need to be in addition to failing to isolate the other two tank valves and that there would only be one valve per tank connected to the same pipework, the probability of spurious opening of the other tank’s valve is estimated as 4.4x10^-5.

· For failure to isolate multiple tanks the probability for two independent failures would be multiplied together (4.4x10^-5x4.4x10^-5= 2x10^-9). For multiple failures, it is usual to allow a common mode failure factor of 0.1 or lower, so for two tanks’ valves spuriously opening the failure probability would be 4.4x10^-6/yr.

· There is a further probability that the spuriously opened valves could not be reclosed before the bund overflowed, taken as 0.1.

13.4.11.9 Combining these together, the estimated frequencies of releases overtopping the bunds from multiple tank failure are:

· Existing tank farm: 1.6x10^-2x0.1x4.4x10^-5x0.1 = 7x10^-9/yr.

· New extension tank farm: 1.6x10^-2x0.1x4.4x10^-6x0.1 = 7x10^-10/yr.

13.4.11.10 The result of these overtoppings can be likened to the instantaneous tank wall failure scenario (Section 13.4.10). For ignition frequencies, we can use the T-11-001/2/3/4/5/6 case for the existing bund and the T-11-018/19/20 case for the new extension bund. This gives overall event frequencies as shown in Table 13-10. The pool spill areas for those wall failure scenarios will also be used for these events when evaluating overall site risk. This is considered a conservative estimate, as it favours spreading towards the highway.

Table 13-10 Multiple Tank failure Event Frequencies

Bund	Event Frequency (/yr)
Bund	Without Construction	With Construction
Existing Bund	9x10^-12	5x10^-10
New extension Bund	4x10^-13	2x10^-11

13.4.11.11 The above frequencies are of a similar level to those for the instantaneous tank wall failures. As was noted in analysis of those events, such low frequencies mean the events are very unlikely.

13.4.12 T10 Boilover

13.4.12.1 A boilover is a potentially hazardous scenario which can occur late in a tank fire incident and result in flaming liquid being ejected from the tank over large areas. However, this phenomenon has never been observed in a fuel as light as Jet A1 and boilover is not relevant to the storage of aviation fuel in the tanks at the AFTF. The cause of a boilover is usually associated with heavy hot residues from combustion of wide boiling range mixtures sinking below the surface and encountering a water layer or other more volatile oil layer. The cause of boilover is therefore not relevant to light refined product storage at all unless there is a significant level of water in the storage tanks. Even with significant quantities of water present, the lower viscosity and narrower boiling range of Jet A1 would mean that such an incident would be very much less dramatic than for crude oil or fuel oil. Even if such an event were to occur at the AFTF it would result in a “froth over” into the bund rather than the long range hazards associated with an explosive boilover and would occur many hours or days into a tank fire incident.

13.4.12.2 The term slopover is also sometimes used synonymously with boilover, or for a less violent event when firewater is applied to the surface of a burning tank fire. As the applied water sinks into the hot heavy oil layer (that can form at the surface of a burning, wide boiling range mixture such as crude oil), it vaporises and entrains burning oil in the process. Even with the addition of firewater as part of fire fighting efforts, ESR are not aware of any case in which such an event was a significant part of the accident progression of a fire on an aviation fuel tank.

13.4.12.3 The additional hazard from this type of event for the AFTF is assessed as leading to zero Hong Kong Link Road fatalities. The frequency would be significantly lower than the tank fire frequency and all resulting consequences are represented within the bund and tank fire frequencies.

13.4.13 T11 Fire due to Release from Top of Tank due to Overfilling

13.4.13.1 Overfilling of atmospheric pressure storage tanks has occurred on many occasions in the past, including the recent major incident initiated by overfilling of a gasoline tank at Buncefield in the UK (see the investigation report for more detail [30]). Unlike Buncefield, the AFTF stores Jet A1, which is much less volatile than gasoline.

13.4.13.2 The maximum flow rate is 3,939m³hr^-1. Therefore the total time for filling an empty tank varies between 4.2 hours and 8.5 hours for the smallest and largest tanks respectively. Control will be available to shut off the supply at the AFTF control room.

13.4.13.3 Emergency shutdown devices are present for all pumps and tanks, and high-high level shut down devices on all tanks. The site will be manned 24 hours per day.

13.4.13.4 The AFTF tanks have similar instrumentation present to many other tanks. In the event that overfilling occurs, the excess Jet A1 would discharge through the tank vents and/or through the frangible shell to roof seam. The fuel would flow down the tank walls, possibly generating some local fuel aerosol, but would not be expected to generate any significant flammable vapour cloud. The most likely outcome is a release which is retained within the bund, and this is covered adequately within the quantification of the bund fire scenario.

13.4.13.5 A cross section of the tank, the bund wall and the boundary fence is shown in Figure 13.3 for the existing tank farm and Figure 13.4 for the new extension tank farm. Sizing differs slightly, but both tank farms have a similar design bund/boundary design. Moving from the tank outwards, this design comprises:

· An inner bund wall rising above the level of the bund floor, spaced at least 10m from the tanks;

· A site road around the bund wall, raised above the level of the bund floor;

· An outer bund, raised from the level of the road, acting as a secondary containment in the event of overtopping the bund;

· A security fence;

· A ditch (note that this is inside the security fence for the new extension tank farm);

· A landscaped lawn area sloping upwards.

13.4.13.6 For overfilling, the maximum discharge rate at the top of the tank will be 3,939m³hr^-1. Although some fragmentation may occur and some splashing of the liquid impacting on the bund floor may occur over the bund wall, this would be expected to be retained within the inner site road. It is highly unlikely that any significant quantities of liquid would splash over the security wall as well and any that did would be expected to be retained within the storm water drains.

13.4.13.7 The incident could release a small volume of Jet A1 and lead to a possible bund fire. Bund fires were considered in Section 13.4.8, where the conclusion drawn was that they would not lead to any fatalities.

13.4.14 T12 Vapour Cloud Explosion/Flash Fire

13.4.14.1 Vapour cloud explosions and flash fires are not normally considered in a risk assessment for storage of Jet A1 since it is stored below its flash point. However, a recent incident on a tank farm storing Jet A1 as well as gasoline and diesel at Buncefield in the UK [30] raises the question of whether a vapour cloud explosion or flash fire should be considered for the AFTF tanks.

13.4.14.2 The incident involved overfilling of a gasoline tank resulting in a large flow of gasoline down the side of the tank. The vapour cloud is understood to have formed due to fragmentation of the flow into droplets and the increased evaporation of the lighter components as a result.

13.4.14.3 There are a number of important differences between the storage of Jet A1 at the AFTF and the overflow of gasoline at Buncefield that started the incident:

· The fuel released was gasoline containing about 10% butane and having a vapour pressure close to 100kPa. This may be compared to the vapour pressure of Jet A1 of <0.1kPa at 20°C. The fuel released at Buncefield would produce a mixture greatly above the lower flammability limit, whilst Jet A1 at the AFTF would produce a mixture well below the lower flammability limit. An overflow of Jet A1 could not therefore support the generation of a flammable vapour cloud in the same way as the overflow of gasoline at Buncefield.

· The weather conditions were calm, cold and stable which would promote flammable gas dispersion over longer distances. These conditions are unlikely at the AFTF.

· A water/ice mist was formed due to the evaporative cooling from the gasoline vaporisation and the high humidity (~99% RH) and low temperature (~0°C). This may have enhanced the explosion overpressure. These conditions are reasonably common around Buncefield, but not applicable at the AFTF.

· Ignition of the vapour cloud probably occurred within a building, which may have enhanced the overpressure. Formation of a significant flammable vapour cloud in the open and its ingress into a building at flammable levels would not occur with Jet A1 at the AFTF.

13.4.14.4 The first factor identified is the most important to the applicability of this type of incident to the AFTF. The gasoline released at Buncefield is capable of forming a flammable vapour cloud that could drift over some distance and be ignited. Jet A1 stored at the PAFF would not form a flammable vapour cloud under the same release from the top of the tank. Some spray may be formed that could burn, but no flammable cloud would be formed that could drift off site.

13.4.14.5 The frequency of a vapour cloud explosion for the AFTF is therefore assessed as zero and Hong Kong Link Road fatalities from such an event are also assessed as zero for Jet A1 in the circumstances at the AFTF.

13.4.15 T13 Fire due to 10% Instantaneous Release from the Top of a Tank

13.4.15.1 A scenario involving a release of ~10% of the tank contents due to failure of the top most plates of the tank, causing splashing of liquid over the bund wall, is evaluated here. The causes of the scenario are identified as due to a fire or explosion failing the weak shell to roof seam, which may also fail the top most plates of the tank. The assessment here is undertaken following a review of the methods used in the assessments for the PAFF and Tung Chung Cable car EIAs [3], [11].

13.4.15.2 A tank head fire/explosion frequency of 1.2x10^-4/yr per tank is identified in Section 13.4.4, and a frequency of 6.6x10^-6/yr per tank was identified for this 10% release scenario in the PAFF Assessment [3]. This is consistent with approximately 5% of the tank explosion/head fire incidents resulting in a 10% release from the top of the tank, which is not unreasonable. The frequency of this scenario is therefore taken as 6.6x10^-6/yr per tank.

13.4.15.3 Following previous methodologies, it is assumed that following a 10% release, 10% will splash over the primary bund, and 10% of that over the secondary bund, leaving a spill of about 30m³ released outside the secondary bund (for an approximately 30,000m³ tank, 30,000x0.1x0.1x0.1=30m³). In the Tung Chung cable car EIA, a test was carried out to assess the likely result of a small release into the grassed area between the tank farm and Scenic Road. This involved discharging water over the outer bund at the worst case angle of 45^o using a fire hose, to determine the maximum range for liquid discharged. This resulted in a maximum spray range of about halfway from the fence to Scenic Road. In this case a release would also be spread over a much greater length of bund wall, so it is unlikely the flow would reach the highway bridge, particularly as it would have low outward momentum due to having to splash over the walls.

13.4.15.4 Furthermore, as in the PAFF assessment, the release would be spread out over ~100m and with a sloping grassed area of 14m or more outside the fence, the average liquid height would be only about 2cm over this region on average. On the basis of this and the Tung Chung Cable Car EIA tests, it is concluded that the flow outside the fence would be limited and would drain back to the gully. In essence, the effects are essentially those of the bund fire (discussed in Section 13.4.8), which was concluded to result in zero fatalities.

13.4.16 T14 Fire on Sea due to Release through Drainage

13.4.16.1 It is possible that Jet A1 could drain to the sea via the site drainage system for the contained areas or via the storm water drains for the roads and drainage ditch between the two security walls. This could result in a fire on the sea due to a release from the tank farm which could have different impacts. Two initial releases could result in a release through the drainage system which would then be separate from the original release:

· A release in a tank bund.

· A release from the areas outside the bund draining via the road.

13.4.16.2 Measures at the AFTF to reduce the likelihood of a jet fuel release to the sea through the drainage system are described in the Tung Chung Cable Care EIA [11] as follows:

“There is no direct discharge of any spilled fuel or stormwater run-off from the area which could be contaminated by fuel without the run-off first passing through an oil-water separator. Valves are provided on the stormwater discharge pipes from the tank farm and will be normally kept closed. These are only opened for discharge of stormwater to the airport drainage system under close supervision of the tank farm operations staff. The provision of oil separators, free swinging gates and outfall penstocks in the “Spill Trap Containment System” further reduces the potential of a fuel oil draining to the sea from the tank farm area.”

13.4.16.3 The location for the outfall of stormwater from the tank farm is marked by the red arrow in Figure 13.8.

13.4.16.4 The tank bunds are contained areas and drain to an interceptor via bund drain valves which should normally be closed (opened only to drain accumulated water). ESR estimate that bund valves may be left open up to 10% of the time on a site. In the PAFF HLA [3], the large release frequency of a two bund tank complex was estimated at 3.2x10^-2/yr. This is considered a conservative estimate for the AFTF. Taking into account the 10% probability of the valve being open, this gives a frequency for a large release to the interceptor of 3.2x10^‑3/yr.

13.4.16.5 An interceptor is not designed to contain large quantities of released fuel and is typically designed to send a signal to the site control room when a high level is detected. With a 24 hour manned operation, any large release would be expected to be stopped promptly leading to a minimal release that could be contained within the drainage system. Additionally, manual valves can be used to isolate the tank bunds if they were not already closed, limiting the inventory to release.

13.4.16.6 The hydrant pumps in the tank farm have a maximum flow rate of 273m³hr^-1 each. A failure resulting in the full flow rate from one of the pumps is considered. Allowing for a 5 minute delay in isolation could lead to a maximum discharge of 23m³ at the export flow rate. It is considered unlikely that a large release would not be detected and isolated within 5 minutes, though it is not impossible. To account for release detection taking longer, a release of up to 137m³ is considered, equal to the full export flow rate for half an hour.

13.4.16.7 For releases via the interceptor, failure of immediate isolation is estimated to have a probability of around 0.1 based on the automated system closing the outlet valve before Jet A1 is discharged to the sea. The probability of failure to isolate the flow at the source, at the valve upstream of the interceptor and at the final outlet valve is assessed based on three failures with nominal probabilities of 0.1 for failure to close a valve, but with a common mode failure factor of 0.1, giving an overall failure probability of 0.01. This is expected to be pessimistic.

13.4.16.8 For the releases via the storm water outlet, isolation of the release relies on manual detection only (including CCTV and observation of process instrumentation readings) and isolation. For isolation within ~5 minutes, we take a typical isolation failure probability of 0.1.

13.4.16.9 This results in two hazardous discharge causes for this scenario:

· A fire due to a release of 23m³ of Jet A1 to the sea resulting in a nominal spill area of 2,300m² for a minimum thickness of 10mm which is required for flame spread. The release frequency is estimated as 3.2x10^-3 releases per year times immediate isolation failure of 0.1 for releases via the interceptor. The resulting pool fire frequency is obtained by multiplying by the marine ignition probability of 0.008, giving an overall frequency of 2.6x10^-6/yr.

· A fire due to a release of 137m³ of Jet A1 to the sea resulting in a nominal spill area of 13,700m² for a minimum thickness of 10mm which is required for flame spread. The release frequency is estimated as 3.2x10^-3 releases per year times delayed isolation failure of 0.01 for releases via the interceptor. The resulting pool fire frequency is obtained by multiplying by the marine ignition probability of 0.008, giving an overall frequency of 2.6x10^-7/yr.

13.4.16.10 In the risk modelling, these two release scenarios are modelled as semi-circular pools, centred at the stormwater outfall location noted in Figure 13.8.

13.4.17 Summary of Frequencies

13.4.17.1 The frequencies for the scenarios possibly leading to fatalities are summarised in Table 13-11.

Table 13-11 Scenario Frequencies

ID	Scenario	Frequency (/yr)
T1	Fire due to discharge from tank vent.	0
T2	Tank head fire/explosion in tank head space.	1.2x10^-4 per tank
T3	Multiple tank head fires.	5.5x10^-5 for existing facility 7.0x10^-5 including new extension facility
T4	Tank failure due to overpressure.	0
T5	Explosion in empty tank (under maintenance).	0
T6	Bund fire.	1.2x10^-5 per bund
T7	Fire outside bund due to rupture/leak of pumps, pipework and fittings.	0
T8	Instantaneous material failure (unzipping/seam failure) of tank: 100% full: T-11-001/2/3/4/5/6 resulting in a pool fire T-11-007/8/9 resulting in a pool fire T-11-018/19/20 resulting in a pool fire 50% full: T-11-001/2/3/4/5/6 resulting in a pool fire T-11-007/8/9 resulting in a pool fire T-11-018/19/20 resulting in a pool fire	Without Construction 4.51x10^-12 2.24x10^-12 1.96x10^-12 2.42x10^-13 1.20x10^-13 1.23x10^-13	With Construction 2.27x10^-10 1.15x10^-10 1.00x10^-10 1.25x10^-11 6.22x10^-12 6.34x10^-12
T8	Aircraft impact resulting in a pool fire of the spill	2.8x10^-10 per tank (2040)
T9	Fire due to multiple tank failure overflowing bund. Existing Bund New extension bund	Without Construction 9x10^-12 4x10^-13	With Construction 5x10^-10 2x10^-11
T10	Boilover.	0
T11	Fire due to release from top of tank due to overfilling.	0
T12	Vapour cloud explosion/flash fire.	0
T13	Fire due to 10% instantaneous release from the top of a tank.	6.6x10^-6 per tank
T14	Fire on sea due to release through drainage	Small release: 2.6x10^-6 Large release: 2.6x10^-7

13.5 Pool Fire Consequence Assessment

13.5.1 The principal hazard to be assessed for the AFTF is Jet A1 pool fires resulting from overtopping fuel releases. Pool fire hazards have been assessed using ESR’s PFIRE2 code [18]. PFIRE2 can model tank head fire and bund fire scenarios, producing the expected flame shape and the thermal flux and fire/smoke plume impact around the source (see Appendix 13C). Based on an assessment of the bund overtopping, PFIRE2 can also model an uncontained pool fire. The surface emissive power for large Jet A1 fires is taken as 10kWm^-2 consistent with the PAFF assessment. The thermal flux outside the flame envelope will always be less than this and will reduce with increasing distance from the fire. Jet A1 pool fires are also predicted to take a significant time to develop, and during this time much lower thermal radiation levels would be experienced outside the pool. Providing a simple escape route is available, fatalities are not expected outside the flame envelope.

13.5.2 The flame and smoke are dragged and tilted downwind. These effects are included in PFIRE2 and the probability of flame drag from contained pool fires is included within the assessment based on available wind data. Unconfined pool fire and its smoke impact are included in the consequence analysis.

13.5.3 The combustion products of aviation fuel include carbon dioxide, nitrogen oxides and sulphur oxides. Incomplete combustion will generate thick black smoke and potentially hazardous gases including carbon monoxide. In the case of fire involving heavier hydrocarbons such as Jet A1 and for large diameter tank/bund fires, smoke production is high. Smoke from such fires is buoyant and the smoke plume is modelled as an extension of the fire plume in PFIRE2. The impact of the smoke of users of the highway is directly included in the calculations on the basis that 100% fatality is assumed for those caught within the fire/smoke plume.

13.5.4 Appendix 13D provides the wind data used. The largest proportion of time (just over 50%) the wind blows at speeds of between 2 and 5ms^-1, with approximately 35% of the time spent at 5 to 10ms^-1, and for a small proportion of time (2%), the wind blows at speeds greater than 10ms^-1. The higher the wind speeds the greater the impact a fire at the tank farm could potentially have upon the highway.

13.5.5 Exposure at Highway From Pool Fires

13.5.5.1 In the PAFF assessment, consistent with other studies in Hong Kong for Jet A1 facilities, the distance to fatality from a pool fire was limited to the edge of the predicted flame envelope. This is due to the low emissive power of Jet A1 pool fires and the opportunity to escape. This approach is considered valid here also, providing traffic on the highway remains free flowing.

13.5.5.2 In the event that traffic is stationary on the highway, due to a traffic jam, exposure times could be much longer. For these circumstances, an evaluation of the probability of fatality based on a thermal dose calculation is undertaken based on escape on foot. In this case it is assumed that an individual using (or constructing) the highway will have to pass through a distance equivalent to the entire diameter of the bund or tank head fire in order to escape the fire and smoke effects of an incident.

13.5.5.3 There are two different scenarios to consider for escape – “Traffic Moving Freely” and “Traffic Blocked”.

Traffic Moving Freely

13.5.5.4 If traffic on the highway is moving freely, then a person using the highway will only be expected to be exposed for a short period of time as they drive away. It is expected that this will be the predominant case for highway users. When moving freely, it has been estimated that the traffic will move at a moderate 45mph, i.e. approximately 20ms^-1.

13.5.5.5 At the existing AFTF, the escape dimension for a contained (and uncontained) bund fire is ~170m, whilst the dimensions of a tank head fire for the large and small tanks are 39m and 27.5m respectively. For the new extension facility the bund fire dimension is ~100m and the tank head fire would be 34m in diameter. Exposure times passing in a car would therefore be 1-2 seconds for a tank head fire and 5-10 seconds for a bund fire.

13.5.5.6 For free moving traffic, fatalities will be limited to the flame/smoke envelope.

Traffic Blocked

13.5.5.7 If the highway is blocked (e.g. because of traffic jams or if the bridge is damaged or engulfed in smoke plume) then a member of the public using the highway will have to vacate their car and walk away from the affected area. In this case the exposure duration will be much longer, but this will occur infrequently. A brisk walking speed is taken as 2ms^-1.

13.5.5.8 For escape on foot, the exposure times would be greatly increased to around 10-20 seconds for a tank head fire and 50-100 seconds for a bund fire.

13.5.5.9 For escape on foot, the thermal dose will be calculated as (Heat flux)^4/3 x Duration of exposure. The probability of fatality is then calculated using the Eisenberg probit, where heat flux is in kWm^-2 and time is in seconds:

Probit = -14.9 + {2.56 x ln(Thermal dose)}

13.5.5.10 Risk levels are generated at ground level and at elevation (i.e. on the highway) during construction and only at elevation for the operational phase.

13.6 Results and Comparison with Criteria

13.6.1 Location Specific Individual Risk (LSIR) plots and an F-N chart have been generated covering three scenarios:

· Construction phase at ground level

· Construction phase at highway height (20m)

· Operational phase at highway height (20m)

13.6.2 Location Specific Individual Risk (LSIR)

13.6.2.1 LSIR levels have been evaluated using the ESR Rifle [34] risk contouring package. LSIR contours make no allowance for the amount of time someone would be present at the location and risk levels for any individual or group (sometimes referred to as Individual Risk Per Annum (IRPA)) will always be less than the LSIR.

13.6.2.2 The LSIR plots are presented in Figure 13.9, Figure 13.10 and Figure 13.11. Note that at the semi-circular contours towards the right of the plots (resulting from the spill to sea event T14), the Link Road is in a tunnel below the bay area while the contours are for 20m above ground level (the height of the raised section of road).

13.6.2.3 The risks drop rapidly beyond the bund wall because the most likely major incident is a bund fire and fatalities are not predicted outside the flame envelope. Flame drag does extend the hazard area beyond the bund, but this depends on wind direction and speed, resulting in a rapid reduction in the risk over 20m outside the bund wall.

13.6.2.4 For each of the three scenarios, the maxima of LSIR over the plot area are shown in Table 13-12. The “Max. LSIR overall” column indicates the maximum LSIR found on the plot. In all cases, this is found inside the circumference of the largest tanks in the existing tank farm. The “Max. LSIR on Hong Kong Link Road” column shows the highest LSIR that occurs along the route of the Hong Kong Link Road. This also occurs in the same area on each plot, specifically the section where it passes over scenic road (this is most easily identified in Figure 13.11, where it is the section of highway within the pink 10^-9 contour).

Table 13-12 LSIR Maxima

Scenario	Max. LSIR overall	Max. LSIR on Hong Kong Link Road
Construction, ground level	1.2x10^-4/yr	2.2x10^-9/yr
Construction, highway level	2.0x10^-5/yr	2.2x10^-9/yr
Operation, highway level	2.0x10^-5/yr	1.4x10^-9/yr

13.6.3 Societal Risk

13.6.3.1 The ESR Rifle code has also be used to calculate societal risk. Using the populations and areas outlined in Section 13.1.5, F-N data covering the three scenarios was generated, as shown in Figure 13.12. The societal risk guidelines identifying unacceptable, ALARP and acceptable F-N areas (see Appendix 13E are also marked.

13.6.3.2 It should be noted that in Figure 13.12 the lines for ground (red) and highway (green) levels at the construction stage have identical data points. The risks in the two scenarios are not identical, as demonstrated in Table 13-12 where there are differing “Max. LSIR overall” values. However, at the range of the highway, the risks fall to the same level, as shown by the same values for “Max. LSIR on Hong Kong Link Road”.

13.6.3.3 For all cases, the risks are clearly well within the ‘Acceptable’ region.

Population Sensivity

13.6.3.4 As described in Section 13.1.5.7, a case with the population during traffic congestion/queuing set ten times higher than the normal operation condition has been assessed to investigate the sensitivity of the results to a higher population density. The result is shown in Figure 13.13. Here, the blue line is the same as in Figure 13.12. The red line is for the case of the same area with ten times as many people present (2280 instead of 228). As would be expected from a ten times increase in population, the red line reaches around a factor of ten further along the ‘No. of Fatalities’ axis.

13.6.3.5 The original population value of 228 on the 950m section of highway is considered the best estimate of the likely population, and this larger population case has been investigated to assess the effect of a higher population. The ten fold increase in population is very extreme, and the resulting F-N curve is still well within the acceptable region.

13.6.4 Cost Benefit and Risk Mitigation

13.6.4.1 Based on the societal risk results, the overall risks lie well within the acceptable region of the criteria in the Technical Memorandum [27] and therefore no further mitigation is necessary.

13.6.4.2 However, it is still possible to estimate the level of investment that might be worthwhile in risk mitigation for events at the tank farm impacting on the Hong Kong Link Road.

13.6.4.3 The Value of a Statistical Life (VOSL) can be considered as the price an organisation is willing to pay to avoid the death of an unknown individual. The value adopted for the VOSL in similar studies in Hong Kong is HKD 33 million [3].

13.6.4.4 To assess if a potential mitigation measure can be justified on cost-benefit grounds, an Implied Cost of Averting a Fatality (ICAF) can be calculated and compared with the VOSL value. ICAF may be calculated as COST OF MEASURE / PLL REDUCTION / LIFETIME. The ICAF is the monetary value that, by implication, is placed on a statistical life by adopting, or failing to adopt, a risk reduction measure.

13.6.4.5 For example, a measure that would eliminate all the risk associated with the Hong Kong Link Road proximity to the tank farm, and introduce no further risks, would reduce the PLL by around 6x10^-8/yr. Such a measure may be possible, for example, by relocating the Hong Kong Link Road beyond the range of any possible incident at the tank farm, providing this introduced no further risks.

13.6.4.6 For a nominal lifetime of 30 years, for the ICAF to be comparable to, or less than, the VOSL the cost of such a measure would need to be comparable to or less than 33,000,000x6x10^-8x 30 = HKD 60.

13.6.4.7 Even minor changes, such as altering drainage, are likely to cost in the range of HKD 1 million or more. Even if a mitigation measure costing ~HKD 1 million could be found that would eliminate the risk, the ICAF would be ~HKD 1 trillion [1] (over 10,000 times the VOSL) and the measure could clearly not be justified on cost benefit grounds.

13.6.4.8 Therefore, no specific risk reduction measures are recommended.

13.6.4.9 Risk mitigation measures for incidents at the AFTF should therefore be limited to good practice, such as ensuring emergency plans are in place for an incident on the tank farm to cover construction and operational phases and ensuring that construction operations are separated from the tank farm and do not impact directly on the tank farm.

13.7 Conclusion

13.7.1 The risks posed to the Hong Kong Link Road by both the existing and new extension sections of the AFTF have been identified and assessed. It is concluded that the risks are acceptable with a significant additional margin. This applies both in the construction phase of the highway and when it is in operation. The primary reason for the low risk level is the separation distance between the tank farm and highway.

13.7.2 In the construction phase, the maximum LSIR at the highway site is calculated as 2.4x10^-9/yr. During operation it is 1.4x10^-9/yr. The difference between these figures is due to the increased level of ignition sources during construction and greater escape speeds during operation. These risk levels are more than a factor of 1000 below the off-site individual risk criterion.

13.7.3 On an F-N basis, calculations show the risks to be well within the defined acceptable region within Annex 4 of the Technical Memorandum [27] for both highway construction and operation. This remains the case, even when the number of people present on the road during the traffic congestion/queuing in which a very conservative assumption of population as ten times larger than the normal operation condition.

13.7.4 Although a full range of tank hazards have been evaluated, the only significant hazard at the Hong Kong Link Road is from major bund overtopping with drainage down the Scenic Road and the surrounding area towards the highway. While not impossible, this is a very unlikely event, presenting very low risk to the highway.

13.7.5 Overall, the risks lie well within the acceptable criteria of Annex 4 of the Technical Memorandum and no additional mitigation measures are considered necessary or justified.

13.8 References

[1] Not Used

[2] Not Used

[3] Hazard to Life Assessment for the Permanent Aviation Fuel Facility (PAFF), ESR Technology, February 2007, ESR/D1000190/001/Issue 2

[4] Judgement in the Court of Final Appeal of the Hong Kong Special Administrative Region, Final Appeal No. 28 of 2005 (Civil) (on appeal from CACV No. 350 of 2003), Between Shiu Wing Steel Limited (Appellant) and Director of Environmental Protection Respondent), Airport Authority Hong Kong (Interested Party), 17 July 2006

[5] Not Used

[6] Quantified risk assessment of aircraft fuelling operations, HSE Contract Research Report CRR 288, P Fewtrell, A Petrie, I Lines, N Cowell, A Livingston, C Jones, W S Atkins, July 2000

[7] Permanent Aviation Fuel Facility Design, PAFF/LC/01/DSG/G/0201 Rev.D, Leighton Contractors (Asia) Limited, Babtie Asia Ltd (note: this document may be continuously revised during the project development)

[8] Section 10 “Hazard to Life Assessment” of the Permanent Aviation Fuel Facility for Hong Kong International Airport Environmental Impact Assessment Report http://www.epd.gov.hk/epd/eia/register/report/eiareport/eia_0772002/EIA%20hyper/Sect10-hazard%20rev1.htm#S10 (accessed 28/11/02 – now superseded).

[9] The SFPE Handbook of Fire Protection Engineering, Third Edition, NFPA, 2002

[10] The Hong Kong EIAO Technical Memorandum http://www.epd.gov.hk/eia/english/legis/index3.html (URL correct on 28^th Jan 2009)

[11] MTR Corporation Ltd, Tung Chung Cable Car Project, Environmental Impact Assessment (Final), Document No. 203842/01/A, March 2003, Section 10, Hazard to Life Assessment. http://www.epd.gov.hk/eia/register/report/eiareport/eia_0902003/Figuresrev1/TOCrev1.htm (URL correct on 28^th Jan 2009)

[12] Guideline for quantitative risk assessment, ’Purple book’, CPR 18E, Publication Series on Dangerous Substances (PGS 3).

[13] HSE. Hazardous Installations Directorate, Safety Report Assessment Guide - Highly Flammable Liquids, available at http://www.hse.gov.uk/hid (URL correct on 28th Jan 2009)

[14] Code of practice for oil storage installations 1992, Building Authority, Hong Kong

[15] Risk criteria for land-use planning in the vicinity of major industrial hazards, HSE 1989

[16] Loss prevention in the process industries, second edition, F P Lees, 1996.

[17] Bund effectiveness in preventing escalation of tank farm fires, T Davies, A B Harding, I P McKay, R G J Robinson, A Wilkinson, Process Safety and Environmental protection, 74, Part B, 88-93, May 1996. (Note: the authors of this paper are listed alphabetically - the address for correspondence is Dr A Wilkinson)

[18] A description of and user’s guide to the pool fire computer code PFIRE2, CMT/01/91, K Kinsella, D Jones, AEA Technology, 1991

[19] A model for the ignition probability of flammable gases, Phase 2, H Spencer, J H Daycock and P J Rew, Contract Research report 203/1998, prepared by WS Atkins HSE

[20] Bund overtopping – the consequence of catastrophic tank failure, A M Thyer, I L Hirst, S F Jagger, Journal of Loss Prevention in the Process Industries 15 (2002) 357-363

[21] D.W. Phillips “Criteria for the rapid assessment of the aircraft crash rate onto major hazard installations according to their location””, United Kingdom Atomic Energy Report SRD/HSE R 435, 1987

[22] P.G. Cowell et al “A methodology for calculating individual risk due to aircraft accidents near airports”

[23] Not Used

[24] Meteorological data for Hong Kong International Airport from 2003 to 2007, supplied by Ove Arup and Partners Hong Kong Limited, 4 Aug 08 (email titled “HZMB HKLR:Quantitative Risk Assessment)

[25] Advisory Committee on Dangerous Substances, Major hazard aspects of the transport of dangerous substances, Page 188, HMSO

[26] Development of pool fire thermal radiation model, P J Rew and W G Hulbert, HSE Contract Research Report 96/1996

[27] The Hong Kong EIAO Technical Memorandum Annex 4: Criteria for evaluating air quality impact and hazard to life http://www.epd.gov.hk/epd/eia/english/legis/memorandum/annex4.html (URL correct on 28th Jan 2009)

[28] Independent Review of Hazard Assessment of Proposed Permanent Aviation Fuel Facility for Hong Kong International Airport, A report for Shiu Wing Steel Limited, Marc McBride, Health and Safety Laboratory (HSL), 12 June 2003, HSL Job No. JC400115, HSL Registry File FR/04/2003/21369, FS/03/11

[29] The Buncefield Investigation Progress report, Buncefield Major Incident Investigation

[30] Buncefield Major Incident Investigation. Initial Report to the Health and Safety Commission and the Environment Agency of the investigation into the explosions and fires at the Buncefield oil storage and transfer depot, Hemel Hempstead, on 11 December 2005, Buncefield Major Incident Investigation Board.

[31] Sustainable Concrete Industry Forum, “Concrete and Fire”, http://www.sustainableconcrete.org.uk/main.asp?page=196 (URL correct on 9th March 2009)

[32] Offshore Hydrocarbon Release Data, HSE OSD, 2005, from HSE on-line database, https://www.hse.gov.uk/hcr3 (URL correct on 9th March 2009)

[33] AEA Technology Report for UKOOA, 'An Analysis of the OIR12 Data and its use in QRA', AEAT/NOIL/27564001/002(R) Issue 1, 6 February 2001.

[34] RIFLE – Risk of Individual Lethality Location Evaluator, D M Webber and N Ketchell, AEA Technology, 1995.

[35] Environmental Impact Assessment Ordinance (Cap. 499), Section 5 (7), Environmental Impact Assessment Study Brief No. ESB-110/2003, Project Title: Hong Kong – Zhuhai – Macao Bridge Hong Kong Section and North Lantau Highway Connection, Hong Kong Environmental Protection Department, http://www.epd.gov.hk/eia/register/study/latest/esb-110.htm, (URL correct on 18th March 2009)

[36] Offshore Reliability Data 4^th Edition, 2002

[37] Major Hazards Incidents Data Service developed by AEA Technology plc on behalf of the Major Hazards Assessment Unit of the United Kingdom Health and Safety Executive (HSE)

[1] 1 trillion = 1,000 billion = 1,000,000 million = 10¹²