Catastrophic	Release	Potential 15	September	2015

Contract	No.	EP

- R9

- 15

- 01 Sequential	Deliverable	No.	3 1 Via	email	to: Tom	Huetteman Email	cc	to: Jinky	Callado
Steven	Linder Omer	Shalev, and Bob	Pallarino,



# Catastrophic	Release	Potential at Red	Hill	Fuel	Storage	Facility

Introduction

The	Navy	is	conducting	facility	studies	and	preparing	engineering	plans	for	improvements at the	Red	Hill Bulk	Fuel	Storage	Facility	to	establish	a	continuing	operating	plan	extending	at	least	several	decades.	The US	EPA	Region	9	asked	PEMY	Consulting	LLC	( PEMY)	to	evaluate	the	potential	for	a	catastrophic	release	of liquid petroleum	from	the	Red	Hill	facility.



### Qualifications
PEMY	is	an	engineering	consultancy	specializing	in	the	design,	operation,	construction

, and	risk	assessment of	petroleum	storage	tank facilities.	PEMY’s	core	expertise	in	risk	mitigation	and	failure	analysis	of petroleum	storage	infrastructure	uniquely	qualifies	it	to	address	the	catastrophic	release	concern. Specifically,	PEMY	has	extensive	experience	in	risk	assessment	methods	as	appli ed	to	the	potential	for leaks,	spills,	and	fire	related	incidents	at	petroleum	storage	facilities.



### Risk	Scenario	Definition
This	memo	addresses	the	potential	for	a	catastrophic	release	from	the	Red	Hill	facility.	There	is	not	a universally	accepted	definit ion	of	“catastrophe,”	but	the	term	carries	implications	of	(a)	suddenness	and	(b) widespread	damage.	The	risk	scenarios	discussed	in	the	balance	of	this	document	focus	on	events	capable of	creating	a	large	breach	in	the	tanks,	several	inches	in	diameter,	t hrough	which	the	tank	contents	could escape	uncontrolled	in	sufficient	volume and	rate to	create	unsafe	conditions	inside	the	facility	and/or impact	the	groundwater	resource	near	and	beneath	the	site.



### Limitations	and	Guidelines	for	Use

Because	detailed and	complete	information	normally	used	in	risk	assessments	is	not	currently	available	it is	important	to	understand	the	limitations	of	statements	made	in	this	memo	or	conclusions	reached resulting	from	this	memo.	PEMY	does	not	have	access	to	detailed	facil ity	information	and	operational procedures	that	are	required	to	conduct	a	risk	assessment.	This	memo	is	not	a	risk	assessment	even	though it	does	discuss	one	limited	aspect	of	risk	at	the	Facility.	Rather,	this	discussion	should	be	considered	an opinion	su bject	to	refinement	as	more	details	become	available	about	the	design,	engineering,	construction, maintenance,	installation,	and	operation	of	not	only	the	tank	system	but	also	the	integral	accessory facilities	such	as	the	piping,	the	terminal,	the	loading and	unloading	areas, the	control	systems, the
emergency	response	systems ,	and	other	infrastructure	and	procedures

.Catastrophic	Release	Potential 15	September	2015

Contract	No.	EP

- R9

- 15

- 01 Sequential	Deliverable	No.	3 2 

## Red	Hill	Facility	Description

The	Red	Hill	Bulk	Fuel	Storage	Facility	(Red	Hill)	is	a	deeply	embedded	system	of	20	vertical	cylindrical

stora ge	tanks	constructed	in	cavities	mined into a	basalt	ridge	on	the	southwest	flank	of	the	Koolau

Mountains .	Access	tunnels,	surge	tanks,	and	pump	stations	connect	the	tanks.	Figure	1	(below)	shows	a simple	overview	of	the	facility	relative	to	surrounding	ro ads	and	topographic	features.

Figure 1

- Red	Hill	Bulk	Fuel	Storage	Facility



### Tank	Construction

The	20	tanks are configured	in	two	parallel	rows.	Each	tank	measures	approximately	245	feet	high	and	100
feet	in	diameter	for	a storage	volume	of	about	12.5	million	gallons	per	tank.	The	upper	domes	of	the	tanks lie	at	depths	varying	between	approximately	100	feet	and	200	feet	below	the	existing	ground	surface. The tank	bottoms	are	about	100	feet	above	the	local	basal	aquifer.

Tank s	1	to	20	were	constructed	by	mining	vertical	shafts	into	the	basalt	bedrock	of	Red	Hill	to	create	a vault	for	each	tank.	The	tank	shape	includes	a	cylindrical	central	barrel	with	dome	structures	at	the	top	andCatastrophic	Release	Potential 15	September	2015

Contract	No.	EP

- R9

- 15

- 01 Sequential	Deliverable	No.	3 3 bottom.	The	reinforced	concrete	liner	is	2.5 feet	thick	on	the	barrel	sides	and	up	to	4	feet	thick	under	the bottom	dome.	After	the	concrete	was	affixed	to	the	bedrock,	a	1⁄4”	thick	steel	liner	was	installed	and	any gaps	between	the	concrete	and	steel	were	sealed	with	grout.	The	overall	structure	trans fers	hydrostatic pressures	from	the	fuel	directly	through	the	tank	body	and	into	competent	bedrock.



### Tank	Contents
Fuel	stored	in	the	tanks	is	classified	as	NFPA	Class	2	liquids,	commonly	called	combustible	liquids.	These liquids	have	flash	points	above	100 degrees	F,	which	means	that	they	do	not	generate	enough	vapor	at	the liquid	surface	to	ignite	if	an	ignition	source	is	located	at	the	surface	of	the	liquid.	The	combustible	liquids stored	at	Red	Hill	have	a	very	different	risk	profile	from	common	flammabl e	liquids	like	motor	and	aviation gasoline	and	paint	thinner.



## Facility	Risk	Evaluation

It	is	a	fair	question	to	ask	“ what	is	the	potential	for	a	catastrophic	release	of	f uel	from	the	Red	Hill	facility?” Typically	in	formal	risk	assessments	this	question	is framed	in	terms	of	annual	failure	probabilities	or exceedance	intervals,	which	can	be	incomprehensible	to	the	layperson.	A	working	knowledge	of	probability as	well	as	a	frame	of	reference	based	in	experience	for	comparison	to	other	kinds	of	risk	events	is necessary	to	engage	in	a	detailed	risk	evaluation.	Here	we	will	provide	an	informal	approach	that	should lead	to	a	better	understanding	of	the	risks	sufficient	for	the	layperson	to	judge	the	vulnerability	of	the region	near	Red	Hill to	events	that	would	c ause a	threat	to	public	safety	and	environmental	resources.

In	order	to	accomplish	this	we	must	first	understand	what	risk	is.	While	there	are	many	definitions,	the most	common	and	robust	definition	of	risk	is	based	on	the	work	of	Kaplan	and	Garrick	(1981) ,	defining	risk as	the	answer	to	three	questions:

1. What	can	happen?

2. How	likely	is	it?

3. If	it	does	happen,	what	are	the	consequences?

We	will	take	this	approach	in	attempting	to	provide	insight	abo ut	the	risks	associated	with	a	“catastrophic

release” .	We	will ignore	the	thousands	of	minor	types	of	incidents	that	can	occur.



## What	Has	Happened

Past	incidents	are	often	a	good	indicator	of	the	future	in	terms	of	understanding	potential	failure	modes. Red	Hill	has	not	experienced	a	catastrophic	failure	event	over	th e	facility’s	70

- year	operating	history. Moreover,	no	receptor	exposure	like	groundwater	contamination	has	been	documented	that	could	have resulted	in	illness,	injury,	or	environmental	impairment 1

. This	is	not	say	that	the	future	can’t	bring	about	a	catastr ophic	event.	Aging	equipment	is	known	to	have	a failure	rate	that	increases	with	time.	But	upgrading,	inspection	and	testing	compensate	to	an	extent	for	age related	deterioration.	An	effective	operating	plan,	including	the	plan	that	the	Navy	has	undertaken to develop,	allocates	effort	and	resources	to	maintaining	an	acceptable	risk	profile as equipment	ages.

1 Injuries	and	fatalities	have occurred	in	the	construction,	testing	and	inspection	of	the	facility	that	are	excluded	from	this	assessment .	T hose types

of	losses are	common	to	all	large	construction	projects,	especially	when	considering	the	era	of	construction.Catastrophic	Release	Potential 15	September	2015

Contract	No.	EP

- R9

- 15

- 01 Sequential	Deliverable	No.	3 4 

## What	Can	Happen?

The	approach	to	asking	qu estions	about	risk	starts	with	“ What	can	happen? ” Immediately,	natural catastrophes	such	as	earthquakes,	sto rms,	tsunamis	and	the	like	come	to	mind.	As	discussed	in	a subsequent	section,	earthquake	risk	is	the	natural	hazard	that	requires	detailed	consideration.	Many	of	the
other hazards can	be	considered	briefly	and	dismissed	because	of	the	facility’s	site	sele ction	and

construction	methods.

Flooding	from	torrential	rainfall is	not	a	problem	since	the	Red	Hill	tanks	are	buried	at	elevations	well above	sea	level	and	the	access	tunnels	provide	excellent	gravity	drainage if any	stormwater	were	to
infiltrate	down	to the	tanks.

Erosion is	similarly	not	a	hazard	because	of	the	depth	that	the	tanks	are	embedded	in	bedrock	and	the

erosion	resistance	of	the	hard	basalt	into	which	the	tanks	were	built.

Landslides are	not	a	credible	hazard	at	the	site	because	the	tanks	were built	into	cylindrical	caverns excavated	into	basalt	bedrock.	Damaging	landslides	do	occur	on	Oahu,	most	commonly in	residual	soils	that
formed by	basalt	weathering over	geologic	time	since Koolau volcano	became	inactive .	Where landslides occur,	though,	t he	slide	plane	is	near	the	boundary	between	surficial	weathered	soil	(red	dirt)	and	the underlying	bedrock.	The	tops	of	the	Red	Hill	tanks	are	well	below	the	surficial	soil	layer	and	not	susceptible

to	landslide.

Volcanic	slump is	a	credible	hazard	on	the flanks	of	active	volcanoes.	The Koolau Mountains,	though, have

been	inactive	for	about	2 million	years 2 and	have	no	potential	for	slumping.

Tsunami	inundation is	not	a	hazard	because	the	site	is	several	hundred	feet	above	sea	level	and	far	enough

inland	to be	well	outside	the	inundation	zone.



### Earthquake	Shaking
Perhaps	the	most	common ad	hoc concern	is	the	issue	of	earthquakes.	Oahu	has	experienced ground shaking	from	several small	and	medium

- sized	earthquakes	and	is	considered	to	have	moderate	seismicity. There	are	a	number	of	different	aspects	to earthquake risk that	bear	evaluation.	The	two	most	important

are (a) the	record	of	past	shaking	and (b) the	potential	for	future	shaking by an earthquake	that might

occur	on a source that	has	not	had	an	event	during	recorded	history

. 

### Historical	Damaging	Earthquakes The	last	earthquake	that	damaged	property	on	Oahu	was	the	October	15,	2006	Hawaii	earthquake	on	the
Kona	side	of	the Big	Island.		Almost	all	damaging	earthquakes	in	Hawaii, in	fact,	occur	on	or	near	the	Big
Island.		The	2006	event	cause d	a	14

- hour	blackout	on	Oahu.	P rior	earthquakes	have	caused	minor	damage like	broken	windows.	Attenuation	with	distance	is	the	reason	that	damaging	earthquakes	on	the	Big	Island do	not	cause	p roblems	on	Oahu.		The	2006	epicenter	is	more	than	150	miles	away	from	Red	Hill. The risk	at
Red	Hill	is	small	because	t he	seismogenic	potential	of	the	Big	Island	source	is	limited	to	magnitude	7	or	7.5 events,	too	small	to	damage	the	Facility	located	more than	150	miles	away

.

2 C inder	cone	development on	the	east side	of	the	Koolau	range that	formed Diamond	Head	and	Koko	Head is	a	differe nt	process	from	shield

building and	is	not	associated	with	earthquakes	or	slumps.Catastrophic	Release	Potential 15	September	2015

Contract	No.	EP

- R9

- 15

- 01 Sequential	Deliverable	No.	3 5 There	are	no	records	of	damaging	earthquakes	occurring	close	to	the	site.	The	largest	earthquake	recorded within	50	miles	of	the	site	was	a	Magnitude	4.48	event	on	May	25,	1969.		The	most	recent	event	of Magnitude	4.0	or	larger	was	on August	22,	2014.	Neither	caused	damage	on	Oahu	or	at	the	Red	Hill	facility.



### Unprecedented Earthquakes Seismicity	in	Hawaii	is	correlated	with	active	volcanism.	Since	the Koolau volcano	has	been	inactive	for
about	2 million	years,	there	is	not	a	credible	ne arby	seismic	source. There	are	no	seismogenic	faults	in

Hawaii	like	there	are	in	Ca lifornia

. The	Hawaiian	Islands	are	located	in	the	interior	of	the	Pacific	Plate	far	from	the	edges	where it interacts with	other	tectonic	plates. Earthquakes	along	plate	mar gins	can,	in	some	locations,	have	long	recurrence
intervals.	The	Cascadia	Subduction	Zone near	Oregon	and	Washington is an	example	of areas	where	large earthquakes	are	possible	but	infrequent. While	tsunamis	caused	by	these	distant	earthquakes	do

sometimes reach	the	Oahu	shoreline,	ground	shaking	does	not.

Separate	from	a	seismogenic	fault	or	a	tectonic	plate	interface,	an	unexpected	shift	in	Pacific	Plate	interior may	be	capable	of	generating small earthquakes	at	an	essentially	random	location. This	type	o f	seismicity may	be	the	cause	of	the	1969	and	2014	events	discussed	in	Historical	Seismicity	above. Shaking	from	such an	event	could	damage	poorly	built	or	old	structures,	but	not	structures	that	are	buried	in	bedrock like	the

Red	Hill	tanks

.



### Seismic	Haza rd A	more	formal	method	of	quantifying	seismic	hazard	at	Red	Hill	is	with	the	probabilistic	seismic	hazard maps	that	the	United	States	Geological	Survey	publishes,	and	which	are	the	basis	for	the	seismic	design provisions	in	the	International	Building	Code 3 .	The	details	of developing	and	using	probabilistic seismic hazard	maps	are	beyond	the	purpose	of	this	memo,	but	there	is	some	useful	basic	information	available that	will	help	to	explain	the	risk	of	earthquake	damage	at	Red	Hill.

First,	an	understanding of	relative	seismic	hazard	may	be	useful.	The	USGS	reports	that one	pertinent aspect	of	the design

- level 4 ground	shaking	at	Red	Hill is a	peak	ground	acceleration	of	PGA	=	0.265	g.	On	its own	this	parameter	is	not	adequate	for	a	complete	understanding	of	s eismic	risk,	but	it	does	allow correlation	with	other	areas	with	a	range	of	seismic	hazard.

3 http://earthquake.usgs.gov/designmaps/us/application.php

4 “Design	level”	is	a	gene ric	term	that,	for	this	evaluation,	means	the	level	of	ground	shaking	on	bedrock	that	has	a	2%	chance	of	being	exceeded	in
50	years.	This	level	of	risk	roughly	correlates	to	a	2,475

- year	recurrence	interval.Catastrophic	Release	Potential 15	September	2015

Contract	No.	EP

- R9

- 15

- 01 Sequential	Deliverable	No.	3 6 Figure	2	(right)	shows	the	design	PGA	for	Red	Hill compared	to five	Mainland	locations. The	comparisons

illustrate	how:

Almost all locations in the US have at least some 1.

seismic hazard, including Denver and New York City,
which are not co nsidered prone to earthquakes.

Knoxville is the population center with seismic hazard 2.

mo s t comparable to Red Hill. Similar to Oahu, Knoxville

is an area affected by mod erate and infrequent earthquakes that are not particularly hazardous.

The design

- level ground motion at Red Hill is less than 3.

half of that for downtown San Francisco, an area of

well

- kno wn high seismicity.


### Seismic	Vulnerability
The	catastrophic	release risk	at Red	Hill	is	comprised	of	both	seismic	hazard	and	also	the	vulnerability	of the	tank	structures.		The	seismic	hazard	is	moderate,	so	noticeable	shaking	has	about	a	2%	chance	of

occur ring	in	a	50

- year	period.	The	tank	structures,	though,	are	very	tolerant	of	shaking	because:

1. The	tank	walls	are	surrounded	by	and	connected	to	bedrock.	This	type	of	shaking	is	very	different from	shaking	that	affects	a	building,	for	instance.

2. The	steel	tan k	shells	are	flexible	and	able	to	accommodate	any	small

- magnitude	temporary deformations	during	shaking.

3. The	tanks	are	2.5	times	narrower	than	they	are	tall,	significantly	limiting	the	sloshing	loads	that	can be	generated in	the	stored	liquid during	shakin g.

Considering	these	factors,	it	is	not	feasible	that	moderate	earthquake	shaking	from	a	distant	source	would breach	the	tank	liners	to	cause	a	catastrophic	release.	While	the	additional	detail	in	this	report	is probably

appr opriate,	the	result	is	the same: earthquake	is	not	a	credible	source	of	catastrophic	failure	risk.



## Other	Facilities

Piping
As	indicated	in	the	first	figure,	there	are	several	miles	of	large	diameter	piping	that	allow	fuel	to	be	pumped into	and	out	of	the	tanks.	Piping,	if	correctly designed,	is	flexible	and	able	to	withstand	severe	ground shaking.	Today,	sophisticated	finite	element	analyses	can	be	used	to	compute	stresses,	flexibility	and deformation	in	pi pes	and	fittings.	Any	“hard	spot s ” that	might	exist in	the	system	may	be	vulne rable	to stress	concentration	during	deformation,	which	can	cause	cracking	or	tearing	and	could	result	in uncontrolled	release.	As	part	of	the	risk	assessment	for	the	facilities,	a	complete	piping	flexibility	analysis

can	be	conducted.



### Fittings

In	addition to	the	piping	flexibility	issue,	screwed	or	flanged	connections	can	be	vulnerable	to	deformation that	would	allow	an	uncontrolled	release.	A	review	of	the	proper	kinds	of	fittings	and	joints,	their Figure 2

- Red	Hill	Seismicity	ComparisonCatastrophic	Release	Potential 15	September	2015

Contract	No.	EP

- R9

- 15

- 01 Sequential	Deliverable	No.	3 7 metallurgical	properties,	and	the ir present	condition	can ensure	that	the	joints	are	as	good	as	the	piping	in terms	of	mechanical	integrity.



### Pumps	and	Appurtenances
There	are	other	system	vulnerabilities	such	as	those	associated	with	pump	seals,	sampling	lines,	tubing	and
other	sources	of	releases. A	potential	r elease	on	one	of	t hese	sources	would	not	generally	be	considered large	enough	to create	a	catastrophe

. Nonetheless ,	ensuring	adequate	mechanical	integrity	through	various

risk	assessment	tools is appropriate

.



### Communications	and	Control
Day

- to

- day operation s	are	managed	by	communication	systems,	control	systems,	alarms

, and	interlocks. The	network	of	such	controls	can	lead	to	failures	that	result	in	releases	or	loss	of	containment.	A	thorough review	of	these	systems	will	allow	for	the	determination	of:

• How closely	these	systems	align	with	current	best	practices,

• How	reliable	and	robust	the	alarm	systems	are that	will provide	early	warnings	and	minimization of	release	size,

• The	human

- machine	interface	and	design	considerations	related	to	human	factors,

• The	us e	of	modern	alarm	management	philosophy	as	capture	by	standards	such	as	ISA	18.2.



## Emergency	Response

Emergency	response	procedures	are	based	on	the	assumption	that	uncontrolled	releases sometimes occur. Reasonable	and	likely	scenarios	are	then	analyzed	to ensure	that	the	response	to	the	assumed	release	is thoroughly	and	adequate ly addressed	through	communication	with	the	emergency	response	personnel,	the facility	owners,	the	medical	facilities,	the	pre

- arranged	clean	up	contractors,	and	the	public	and	its

l eadership.

Part	of	the	assessment	certainly	involves	emergency	response.	It	is	uncertain	to	PEMY	how	robust	the entire	emergency	response	system	is,	the	incident	command	system,	and	the	quality of	equipment	and training	provided	to	the	operators	responsibl e	for	emergency	response.	This	assessment	typically	is	best done	by	an	independent	third	party	review er that	has	experience	in	these	areas	and	with	the	types	of
release	involved.



## Summary	and	Conclusions

The Red	Hill tanks	have	very	low	potential	for	a	cata strophic	release.	The	tanks	are	embedded	in	bedrock

100	to 20 0	feet deep	that	makes	them	well protected	from	geologic	and	natural	hazards.	There	are	no credible	mechanisms	that	could	rapidly	cause	a	large	breach	in	a	tank	wall	and	allow	a	damaging	release of stored	liquids.

A	catastrophic	failure	would	require	more	than	one	type	of	failure	occurring	on	more	than	one	system comprising	the	facility,	and	could	involve	elements	of	management,	controls,	and	operations	as	well	as mechanical	integrity	of	tank	line r,	pipes,	and	valves.	These	types	of	risk	are	complex	and	are	best	evaluated using	broad,	multidisciplinary	methods	that	consider	all	elements	of	the	facility	and	its	operation.

That	the	tanks	alone	have	little	catastrophic	risk	is	not	unexpected.	Rather	i t	is	the	totality	of	the	system and	subsystems	that	require	investigation	and	analysis.	A	preliminary	review	by	an	independent	3 rd partyCatastrophic	Release	Potential 15	September	2015

Contract	No.	EP

- R9

- 15

- 01 Sequential	Deliverable	No.	3 8 qualified	to	analyze	systemic	and	operations	issues	is	necessary	to	thoroughly	understand	the	Red	Hill Facility’s	risk profile.	Further	information	combined	with	neutral	independent	investigation	taking	into account	all	aspects	of	the	facility	including	but	not	limited	to	materials,	fabrication	methods,	construction, operation,	maintenance,	and	safeguards	is	needed	to	unde rstand	what	risks	the	Navy	facility	poses to population	and	environmental	resources.