Catastrophic	Release	Potential

15	September	2015

Contract	No.	EP-R9-15-01

Sequential	Deliverable	No.	3

1

Via	email	to: Tom	Huetteman Email	cc	to: Jinky	Callado

Steven	Linder

Omer	Shalev,	and

Bob	Pallarino,

Catastrophic	Release	Potential at

Red	Hill	Fuel	Storage	Facility

Introduction

The	Navy	is	conducting	facility	studies	and	preparing	engineering	plans	for	improvements	at the	Red	Hill	

Bulk	Fuel	Storage	Facility	to	establish	a	continuing	operating	plan	extending	at	least	several	decades.	The	

US	EPA	Region	9	asked	PEMY	Consulting	LLC	(PEMY)	to	evaluate	the	potential	for	a	catastrophic	release	of	

liquid	petroleum	from	the	Red	Hill	facility.

Qualifications

PEMY	is	an	engineering	consultancy	specializing	in	the	design,	operation,	construction, and	risk	assessment	

of	petroleum	storage	tank	facilities.	PEMY’s	core	expertise	in	risk	mitigation	and	failure	analysis	of	

petroleum	storage	infrastructure	uniquely	qualifies	it	to	address	the	catastrophic	release	concern.	

Specifically,	PEMY	has	extensive	experience	in	risk	assessment	methods	as	applied	to	the	potential	for	

leaks,	spills,	and	fire	related	incidents	at	petroleum	storage	facilities.

Risk	Scenario	Definition

This	memo	addresses	the	potential	for	a	catastrophic	release	from	the	Red	Hill	facility.	There	is	not	a	

universally	accepted	definition	of	“catastrophe,”	but	the	term	carries	implications	of	(a)	suddenness	and	(b)	

widespread	damage.	The	risk	scenarios	discussed	in	the	balance	of	this	document	focus	on	events	capable	

of	creating	a	large	breach	in	the	tanks,	several	inches	in	diameter,	through	which	the	tank	contents	could	

escape	uncontrolled	in	sufficient	volume and	rate to	create	unsafe	conditions	inside	the	facility	and/or	

impact	the	groundwater	resource	near	and	beneath	the	site.	

Limitations	and	Guidelines	for	Use

Because	detailed	and	complete	information	normally	used	in	risk	assessments	is	not	currently	available	it	

is	important	to	understand	the	limitations	of	statements	made	in	this	memo	or	conclusions	reached	

resulting	from	this	memo.	PEMY	does	not	have	access	to	detailed	facility	information	and	operational	

procedures	that	are	required	to	conduct	a	risk	assessment.	This	memo	is	not	a	risk	assessment	even	though	

it	does	discuss	one	limited	aspect	of	risk	at	the	Facility.	Rather,	this	discussion	should	be	considered	an	

opinion	subject	to	refinement	as	more	details	become	available	about	the	design,	engineering,	construction,	

maintenance,	installation,	and	operation	of	not	only	the	tank	system	but	also	the	integral	accessory	

facilities	such	as	the	piping,	the	terminal,	the	loading	and	unloading	areas, the	control	systems, the	

emergency	response	systems,	and	other	infrastructure	and	procedures.
Catastrophic	Release	Potential

15	September	2015

Contract	No.	EP-R9-15-01

Sequential	Deliverable	No.	3

2

Red	Hill	Facility	Description

The	Red	Hill	Bulk	Fuel	Storage	Facility	(Red	Hill)	is	a	deeply	embedded	system	of	20	vertical	cylindrical	

storage	tanks	constructed	in	cavities	mined	into	a	basalt	ridge	on	the	southwest	flank	of	the	Koolau	

Mountains.	Access	tunnels,	surge	tanks,	and	pump	stations	connect	the	tanks.	Figure	1	(below)	shows	a	

simple	overview	of	the	facility	relative	to	surrounding	roads	and	topographic	features.	

Figure	1 - Red	Hill	Bulk	Fuel	Storage	Facility

Tank	Construction

The	20	tanks	are	configured	in	two	parallel	rows.	Each	tank	measures	approximately	245	feet	high	and	100	

feet	in	diameter	for	a	storage	volume	of	about	12.5	million	gallons	per	tank.	The	upper	domes	of	the	tanks	

lie	at	depths	varying	between	approximately	100	feet	and	200	feet	below	the	existing	ground	surface. The	

tank	bottoms	are	about	100	feet	above	the	local	basal	aquifer.

Tanks	1	to	20	were	constructed	by	mining	vertical	shafts	into	the	basalt	bedrock	of	Red	Hill	to	create	a	

vault	for	each	tank.	The	tank	shape	includes	a	cylindrical	central	barrel	with	dome	structures	at	the	top	and	
Catastrophic	Release	Potential

15	September	2015

Contract	No.	EP-R9-15-01

Sequential	Deliverable	No.	3

3

bottom.	The	reinforced	concrete	liner	is	2.5	feet	thick	on	the	barrel	sides	and	up	to	4	feet	thick	under	the	

bottom	dome.	After	the	concrete	was	affixed	to	the	bedrock,	a	1⁄4”	thick	steel	liner	was	installed	and	any	

gaps	between	the	concrete	and	steel	were	sealed	with	grout.	The	overall	structure	transfers	hydrostatic	

pressures	from	the	fuel	directly	through	the	tank	body	and	into	competent	bedrock.

Tank	Contents

Fuel	stored	in	the	tanks	is	classified	as	NFPA	Class	2	liquids,	commonly	called	combustible	liquids.	These	

liquids	have	flash	points	above	100 degrees	F,	which	means	that	they	do	not	generate	enough	vapor	at	the	

liquid	surface	to	ignite	if	an	ignition	source	is	located	at	the	surface	of	the	liquid.	The	combustible	liquids	

stored	at	Red	Hill	have	a	very	different	risk	profile	from	common	flammable	liquids	like	motor	and	aviation	

gasoline	and	paint	thinner.

Facility	Risk	Evaluation

It	is	a	fair	question	to	ask	“what	is	the	potential	for	a	catastrophic	release	of	fuel	from	the	Red	Hill	facility?”

Typically	in	formal	risk	assessments	this	question	is framed	in	terms	of	annual	failure	probabilities	or	

exceedance	intervals,	which	can	be	incomprehensible	to	the	layperson.	A	working	knowledge	of	probability	

as	well	as	a	frame	of	reference	based	in	experience	for	comparison	to	other	kinds	of	risk	events	is

necessary	to	engage	in	a	detailed	risk	evaluation.	Here	we	will	provide	an	informal	approach	that	should	

lead	to	a	better	understanding	of	the	risks	sufficient	for	the	layperson	to	judge	the	vulnerability	of	the	

region	near	Red	Hill	to	events	that	would	cause	a	threat	to	public	safety	and	environmental	resources.

In	order	to	accomplish	this	we	must	first	understand	what	risk	is.	While	there	are	many	definitions,	the	

most	common	and	robust	definition	of	risk	is	based	on	the	work	of	Kaplan	and	Garrick	(1981),	defining	risk	

as	the	answer	to	three	questions:

1. What	can	happen?

2. How	likely	is	it?

3. If	it	does	happen,	what	are	the	consequences?

We	will	take	this	approach	in	attempting	to	provide	insight	about	the	risks	associated	with	a	“catastrophic	

release”.	We	will ignore	the	thousands	of	minor	types	of	incidents	that	can	occur.

What	Has	Happened

Past	incidents	are	often	a	good	indicator	of	the	future	in	terms	of	understanding	potential	failure	modes.	

Red	Hill	has	not	experienced	a	catastrophic	failure	event	over	the	facility’s	70-year	operating	history.	

Moreover,	no	receptor	exposure	like	groundwater	contamination	has	been	documented	that	could	have	

resulted	in	illness,	injury,	or	environmental	impairment1.

This	is	not	say	that	the	future	can’t	bring	about	a	catastrophic	event.	Aging	equipment	is	known	to	have	a	

failure	rate	that	increases	with	time.	But	upgrading,	inspection	and	testing	compensate	to	an	extent	for	age	

related	deterioration.	An	effective	operating	plan,	including	the	plan	that	the	Navy	has	undertaken to	

develop,	allocates	effort	and	resources	to	maintaining	an	acceptable	risk	profile as equipment	ages.	

																																																												 1Injuries	and	fatalities	have	occurred	in	the	construction,	testing	and	inspection	of	the	facility	that	are	excluded	from	this	assessment.	Those types	

of	losses are	common	to	all	large	construction	projects,	especially	when	considering	the	era	of	construction.
Catastrophic	Release	Potential

15	September	2015

Contract	No.	EP-R9-15-01

Sequential	Deliverable	No.	3

4

What	Can	Happen?

The	approach	to	asking	questions	about	risk	starts	with	“What	can	happen?” Immediately,	natural	

catastrophes	such	as	earthquakes,	storms,	tsunamis	and	the	like	come	to	mind.	As	discussed	in	a	

subsequent	section,	earthquake	risk	is	the	natural	hazard	that	requires	detailed	consideration.	Many	of	the	

other hazards can	be	considered	briefly	and	dismissed	because	of	the	facility’s	site	selection	and	

construction	methods.

Flooding	from	torrential	rainfall is	not	a	problem	since	the	Red	Hill	tanks	are	buried	at	elevations	well	

above	sea	level	and	the	access	tunnels	provide	excellent	gravity	drainage	if any	stormwater	were	to	

infiltrate	down	to the	tanks.

Erosion is	similarly	not	a	hazard	because	of	the	depth	that	the	tanks	are	embedded	in	bedrock	and	the	

erosion	resistance	of	the	hard	basalt	into	which	the	tanks	were	built.

Landslides are	not	a	credible	hazard	at	the	site	because	the	tanks	were built	into	cylindrical	caverns	

excavated	into	basalt	bedrock.	Damaging	landslides	do	occur	on	Oahu,	most	commonly	in	residual	soils	that	

formed	by	basalt	weathering	over	geologic	time	since	Koolau	volcano	became	inactive.	Where	landslides

occur,	though,	the	slide	plane	is	near	the	boundary	between	surficial	weathered	soil	(red	dirt)	and	the	

underlying	bedrock.	The	tops	of	the	Red	Hill	tanks	are	well	below	the	surficial	soil	layer	and	not	susceptible	

to	landslide.

Volcanic	slump is	a	credible	hazard	on	the	flanks	of	active	volcanoes.	The	Koolau Mountains,	though,	have	

been	inactive	for	about	2 million	years2 and	have	no	potential	for	slumping.

Tsunami	inundation is	not	a	hazard	because	the	site	is	several	hundred	feet	above	sea	level	and	far	enough	

inland	to be	well	outside	the	inundation	zone.

Earthquake	Shaking

Perhaps	the	most	common	ad	hoc concern	is	the	issue	of	earthquakes.	Oahu	has	experienced ground	

shaking	from	several small	and	medium-sized	earthquakes	and	is	considered	to	have	moderate	seismicity.	

There	are	a	number	of	different	aspects	to	earthquake risk	that	bear	evaluation.	The	two	most	important	

are (a)	the	record	of	past	shaking	and	(b)	the	potential	for	future	shaking	by an	earthquake	that	might	

occur	on	a	source that	has	not	had	an	event	during	recorded	history.

Historical	Damaging	Earthquakes

The	last	earthquake	that	damaged	property	on	Oahu	was	the	October	15,	2006	Hawaii	earthquake	on	the	

Kona	side	of	the	Big	Island.		Almost	all	damaging	earthquakes	in	Hawaii, in	fact,	occur	on	or	near	the	Big	

Island.		The	2006	event	caused	a	14-hour	blackout	on	Oahu.	Prior	earthquakes	have	caused	minor	damage	

like	broken	windows.	Attenuation	with	distance	is	the	reason	that	damaging	earthquakes	on	the	Big	Island	

do	not	cause	problems	on	Oahu.		The	2006	epicenter	is	more	than	150	miles	away	from	Red	Hill.	The risk	at	

Red	Hill	is	small	because	the	seismogenic	potential	of	the	Big	Island	source	is	limited	to	magnitude	7	or	7.5	

events,	too	small	to	damage	the	Facility	located	more	than	150	miles	away.

																																																												 2 Cinder	cone	development on	the	east	side	of	the	Koolau	range that	formed	Diamond	Head	and	Koko	Head is	a	different	process	from	shieldbuilding and	is	not	associated	with	earthquakes	or	slumps.
Catastrophic	Release	Potential

15	September	2015

Contract	No.	EP-R9-15-01

Sequential	Deliverable	No.	3

5

There	are	no	records	of	damaging	earthquakes	occurring	close	to	the	site.	The	largest	earthquake	recorded	

within	50	miles	of	the	site	was	a	Magnitude	4.48	event	on	May	25,	1969.		The	most	recent	event	of	

Magnitude	4.0	or	larger	was	on	August	22,	2014.	Neither	caused	damage	on	Oahu	or	at	the	Red	Hill	facility.

Unprecedented Earthquakes

Seismicity	in	Hawaii	is	correlated	with	active	volcanism.	Since	the	Koolau volcano	has	been	inactive	for	

about	2 million	years,	there	is	not	a	credible	nearby	seismic	source. There	are	no	seismogenic	faults	in	

Hawaii	like	there	are	in	California.

The	Hawaiian	Islands	are	located	in	the	interior	of	the	Pacific	Plate	far	from	the	edges	where	it interacts	

with	other	tectonic	plates.	Earthquakes	along	plate	margins	can,	in	some	locations,	have	long	recurrence	

intervals.	The	Cascadia	Subduction	Zone near	Oregon	and	Washington is	an	example	of	areas	where	large	

earthquakes	are	possible	but	infrequent. While	tsunamis	caused	by	these	distant	earthquakes	do	

sometimes reach	the	Oahu	shoreline,	ground	shaking	does	not.

Separate	from	a	seismogenic	fault	or	a	tectonic	plate	interface,	an	unexpected	shift	in	Pacific	Plate	interior	

may	be	capable	of	generating	small	earthquakes	at	an	essentially	random	location. This	type	of	seismicity	

may	be	the	cause	of	the	1969	and	2014	events	discussed	in	Historical	Seismicity	above.	 Shaking	from	such	

an	event	could	damage	poorly	built	or	old	structures,	but	not	structures	that	are	buried	in	bedrock like	the	

Red	Hill	tanks.

Seismic	Hazard

A	more	formal	method	of	quantifying	seismic	hazard	at	Red	Hill	is	with	the	probabilistic	seismic	hazard	

maps	that	the	United	States	Geological	Survey	publishes,	and	which	are	the	basis	for	the	seismic	design	

provisions	in	the	International	Building	Code3.	The	details	of	developing	and	using	probabilistic seismic	

hazard	maps	are	beyond	the	purpose	of	this	memo,	but	there	is	some	useful	basic	information	available	

that	will	help	to	explain	the	risk	of	earthquake	damage	at	Red	Hill.

First,	an	understanding	of	relative	seismic	hazard	may	be	useful.	The	USGS	reports	that one	pertinent	

aspect	of	the	design-level4 ground	shaking	at	Red	Hill	is a	peak	ground	acceleration	of	PGA	=	0.265	g.	On	its	

own	this	parameter	is	not	adequate	for	a	complete	understanding	of	seismic	risk,	but	it	does	allow	

correlation	with	other	areas	with	a	range	of	seismic	hazard.

																																																												 3 http://earthquake.usgs.gov/designmaps/us/application.php

4 “Design	level”	is	a	generic	term	that,	for	this	evaluation,	means	the	level	of	ground	shaking	on	bedrock	that	has	a	2%	chance	of	being	exceeded	in	

50	years.	This	level	of	risk	roughly	correlates	to	a	2,475-year	recurrence	interval.
Catastrophic	Release	Potential

15	September	2015

Contract	No.	EP-R9-15-01

Sequential	Deliverable	No.	3

6

Figure	2	(right)	shows	the	design	PGA	for	Red	Hill	

compared	to five	Mainland	locations.	 The	comparisons	

illustrate	how:

1. Almost all locations in the US have at least some

seismic hazard, including Denver and New York City,

which are not considered prone to earthquakes.

2. Knoxville is the population center with seismic hazard

most comparable to Red Hill. Similar to Oahu, Knoxville

is an area affected by moderate and infrequent

earthquakes that are not particularly hazardous.

3. The design-level ground motion at Red Hill is less than

half of that for downtown San Francisco, an area of

well-known high seismicity.

Seismic	Vulnerability

The	catastrophic	release risk	at Red	Hill	is	comprised	of	both	seismic	hazard	and	also	the	vulnerability	of	

the	tank	structures.		The	seismic	hazard	is	moderate,	so	noticeable	shaking	has	about	a	2%	chance	of	

occurring	in	a	50-year	period.	The	tank	structures,	though,	are	very	tolerant	of	shaking	because:

1. The	tank	walls	are	surrounded	by	and	connected	to	bedrock.	This	type	of	shaking	is	very	different	

from	shaking	that	affects	a	building,	for	instance.

2. The	steel	tank	shells	are	flexible	and	able	to	accommodate	any	small-magnitude	temporary	

deformations	during	shaking.

3. The	tanks	are	2.5	times	narrower	than	they	are	tall,	significantly	limiting	the	sloshing	loads	that	can	

be	generated	in	the	stored	liquid	during	shaking.

Considering	these	factors,	it	is	not	feasible	that	moderate	earthquake	shaking	from	a	distant	source	would	

breach	the	tank	liners	to	cause	a	catastrophic	release.	While	the	additional	detail	in	this	report	is	probably

appropriate,	the	result	is	the	same: earthquake	is	not	a	credible	source	of	catastrophic	failure	risk.

Other	Facilities

Piping

As	indicated	in	the	first	figure,	there	are	several	miles	of	large	diameter	piping	that	allow	fuel	to	be	pumped	

into	and	out	of	the	tanks.	Piping,	if	correctly	designed,	is	flexible	and	able	to	withstand	severe	ground	

shaking.	Today,	sophisticated	finite	element	analyses	can	be	used	to	compute	stresses,	flexibility	and	

deformation	in	pipes	and	fittings.	Any	“hard	spots” that	might	exist	in	the	system	may	be	vulnerable	to	

stress	concentration	during	deformation,	which	can	cause	cracking	or	tearing	and	could	result	in	

uncontrolled	release.	As	part	of	the	risk	assessment	for	the	facilities,	a	complete	piping	flexibility	analysis	

can	be	conducted.

Fittings

In	addition to	the	piping	flexibility	issue,	screwed	or	flanged	connections	can	be	vulnerable	to	deformation	

that	would	allow	an	uncontrolled	release.	A	review	of	the	proper	kinds	of	fittings	and	joints,	their	

Figure	2 - Red	Hill	Seismicity	Comparison
Catastrophic	Release	Potential

15	September	2015

Contract	No.	EP-R9-15-01

Sequential	Deliverable	No.	3

7

metallurgical	properties,	and	their present	condition	can ensure	that	the	joints	are	as	good	as	the	piping	in	

terms	of	mechanical	integrity.

Pumps	and	Appurtenances

There	are	other	system	vulnerabilities	such	as	those	associated	with	pump	seals,	sampling	lines,	tubing	and	

other	sources	of	releases.	A	potential	release	on	one	of	these	sources	would	not	generally	be	considered	

large	enough	to	create	a	catastrophe.	Nonetheless,	ensuring	adequate	mechanical	integrity	through	various	

risk	assessment	tools	is appropriate.

Communications	and	Control

Day-to-day operations	are	managed	by	communication	systems,	control	systems,	alarms, and	interlocks.	

The	network	of	such	controls	can	lead	to	failures	that	result	in	releases	or	loss	of	containment.	A	thorough	

review	of	these	systems	will	allow	for	the	determination	of:

• How	closely	these	systems	align	with	current	best	practices,

• How	reliable	and	robust	the	alarm	systems	are	that	will provide	early	warnings	and	minimization	

of	release	size,

• The	human-machine	interface	and	design	considerations	related	to	human	factors,

• The	use	of	modern	alarm	management	philosophy	as	capture	by	standards	such	as	ISA	18.2.

Emergency	Response

Emergency	response	procedures	are	based	on	the	assumption	that	uncontrolled	releases	sometimes	occur.	

Reasonable	and	likely	scenarios	are	then	analyzed	to	ensure	that	the	response	to	the	assumed	release	is	

thoroughly	and	adequately addressed	through	communication	with	the	emergency	response	personnel,	the	

facility	owners,	the	medical	facilities,	the	pre-arranged	clean	up	contractors,	and	the	public	and	its	

leadership.

Part	of	the	assessment	certainly	involves	emergency	response.	It	is	uncertain	to	PEMY	how	robust	the	

entire	emergency	response	system	is,	the	incident	command	system,	and	the	quality	of	equipment	and

training	provided	to	the	operators	responsible	for	emergency	response.	This	assessment	typically	is	best	

done	by	an	independent	third	party	reviewer that	has	experience	in	these	areas	and	with	the	types	of	

release	involved.

Summary	and	Conclusions

The	Red	Hill	tanks	have	very	low	potential	for	a	catastrophic	release.	The	tanks	are	embedded	in	bedrock	

100	to	200	feet	deep	that	makes	them	well protected	from	geologic	and	natural	hazards.	There	are	no	

credible	mechanisms	that	could	rapidly	cause	a	large	breach	in	a	tank	wall	and	allow	a	damaging	release	of	

stored	liquids.

A	catastrophic	failure	would	require	more	than	one	type	of	failure	occurring	on	more	than	one	system	

comprising	the	facility,	and	could	involve	elements	of	management,	controls,	and	operations	as	well	as	

mechanical	integrity	of	tank	liner,	pipes,	and	valves.	These	types	of	risk	are	complex	and	are	best	evaluated	

using	broad,	multidisciplinary	methods	that	consider	all	elements	of	the	facility	and	its	operation.

That	the	tanks	alone	have	little	catastrophic	risk	is	not	unexpected.	Rather	it	is	the	totality	of	the	system	

and	subsystems	that	require	investigation	and	analysis.	A	preliminary	review	by	an	independent	3rd party	
Catastrophic	Release	Potential

15	September	2015

Contract	No.	EP-R9-15-01

Sequential	Deliverable	No.	3

8

qualified	to	analyze	systemic	and	operations	issues	is	necessary	to	thoroughly	understand	the	Red	Hill	

Facility’s	risk	profile.	Further	information	combined	with	neutral	independent	investigation	taking	into	

account	all	aspects	of	the	facility	including	but	not	limited	to	materials,	fabrication	methods,	construction,	

operation,	maintenance,	and	safeguards	is	needed	to	understand	what	risks	the	Navy	facility	poses	to

population	and	environmental	resources.