· The operation of new aviation fuel pipelines (submarine and underground) and new fuel hydrant systems for aircraft refuelling operation at the new aircraft stands in the airport expansion area; and

· The operation of new diesel and gasoline storage facilities in the airport expansion area.

6.1.1.5 Based on the latest scheme design, there will be no additional liquefied petroleum gas (LPG) filling station for the third runway project, hence LPG storage will not be considered in this hazard to human life assessment.

1. Identify hazardous scenarios associated with potential construction work damage to aviation fuel pipelines and storage facilities and then determine a set of relevant scenarios to be included in a quantitative risk assessment (QRA);

2. Execute a QRA of the set of hazardous scenarios determined in item 1, expressing population risks in both individual and societal terms;

3. Compare individual and societal risks with the criteria for evaluating hazard to human life stipulated in Annex 4 of the TM; and

4. Identify and assess practicable and cost-effective risk mitigation measures.

Operation Phase: Aviation Fuel Hazards

6.1.2.3 To carry out a hazard assessment to evaluate risks from the operation of new aviation fuel pipelines (submarine and underground) and new fuel hydrant systems for aircraft refuelling operation at new aircraft stands in the airport expansion area. The hazard assessment shall include the following:

1. Identify hazardous scenarios associated with the operation of new aviation fuel pipelines and hydrant systems for aircraft refuelling and then determine a set of relevant scenarios to be included in a QRA;

2. Execute a QRA of the set of hazardous scenarios determined in item 1, expressing population risks in both individual and societal terms;

3. Compare individual and societal risks with the criteria for evaluating hazard to human life stipulated in Annex 4 of the TM; and

4. Identify and assess practicable and cost-effective risk mitigation measures.

Operation Phase: Diesel and Gasoline Hazards

6.1.2.4 To carry out hazard assessment to evaluate the risk due to new facilities for storage of dangerous goods (DG) (i.e. fuel for airside vehicles/ground services equipment). Stored fuels may include diesel and gasoline in the airport expansion area. The hazard assessment shall include the following:

1. Identify hazardous scenarios associated with the above DG facilities and then determine a set of relevant scenarios to be included in a QRA;

2. Execute a QRA of the set of hazardous scenarios determined in item 1, expressing population risks in both individual and societal terms;

3. Compare individual and societal risks with the criteria for evaluating hazard to human life stipulated in Annex 4 of the TM; and

4. Identify and assess practicable and cost-effective risk mitigation measures.

6.1.3 Risk Criteria

6.1.3.1 The individual and societal risk guideline specified in Annex 4 of the EIAO-TM will be applied in the current study.

6.1.3.2 Individual risk is the predicted increase in the chance of death per year to a most exposed individual due to a hazardous operation. When comparing with the risk guidelines, the estimated duration of exposure of the person to the hazardous operation should be taken into consideration. The maximum level of offsite individual risk should not exceed 1 in 100,000 per year, i.e. 1 x 10^-5/yr.

6.1.3.3 Societal risk expresses the risks to the whole population living, working or travelling near a hazardous operation. The societal risk criteria are presented graphically on an F-N Graph as shown in Figure 6‑1.

Figure 6‑1: Hong Kong Societal Risk Criteria

6.1.3.4
There are three regions in the graph, namely ‘Acceptable’ region, ‘ALARP’ region and ‘Unacceptable’ region. The placement of the risk curve on the F-N graph determines what action would be required. These are defined as follows:

· ‘Unacceptable’ region – Risk is so high and outcomes so unacceptable that it cannot be justified on any grounds. Risk should be reduced regardless of the cost of mitigation or operation should not be carried out;

· ‘ALARP’ region – Risk is acceptable only if it is reduced to a level which is as low as reasonably practicable with consideration of all practicable and cost effective measures.;

· ‘Acceptable’ region – Risk is broadly acceptable and further risk reduction is not required.

6.1.3.5 The societal risk criteria have integrated a vertical cut-off line at the 1,000 fatality level extending down to a frequency of 10^-9/yr (1 in a billion years). Any hazardous scenario resulting in more than 1,000 fatalities will be considered as unacceptable and must be avoided.

6.2 Methodology

6.2.1.1 The major tasks involved in the QRA study included hazard identification, frequency assessment, consequence modelling, risk summation and identification of mitigation measures. The details of each of the major tasks were described in the following sections.

6.2.2 Hazard Identification

6.2.2.1 The identification of hazardous scenarios have been achieved by conducting a review of the historical incidents occurred in HKIA and airports worldwide. The historical data can provide important information of the failure events and the associated causes for the spillage incidents.

6.2.2.2 The hazard identification also made reference to the various EIA studies that are relevant to the aviation fuel supply and storage such as the permanent aviation fuel facility for HKIA ^[6], and vehicle fuel filling station such as the Kai Tak Development Engineering Study ^[23] to ensure all the scenarios that are applicable to the scope of the current assessment has been considered.

6.2.2.3 A hazard identification (HAZID) workshop using ‘Structured What If’ (SWIFT) technique has been arranged for verifying the hazardous scenarios identified during the desktop review and to identify new hazards specific to the operation of new aviation fuel pipelines and new fuel hydrant systems for aircraft fuelling operation at the expansion area, and the potential impact to the existing aviation fuel supply system during the construction phase.

6.2.2.4 For each of the specific topics, structured ‘what if’ questions have been posed taking full consideration of the operational modes, sub-system functionality and dependencies, and human interactions, to determine if deviations will result in a foreseeable hazardous state. A list of guidewords has been used to help prompt discussions where necessary. All the identified hazards have been documented in a hazard worksheet which detailed the nature of the hazard, the cause and both the existing and potential mitigation measures.

6.2.2.5 All identified hazardous scenario(s) have been further assessed in the QRA to facilitate the computation of an event or accident frequency.

6.2.3 Frequency Assessment

6.2.3.1 Frequency assessment has been primarily based on historical data and supplemented any deficiencies with data from generic sources. The failure rate data used in the analysis has been based on the collection and analysis of reported incidents in public data sources and records maintained by AAHK.

6.2.3.2 Fault tree analysis (FTA) technique has been adopted to analyse the initiating events of the identified scenarios. FTA is a technique by which many events that interact to produce other events can be related using logical relationship (AND, OR, etc.). These relationships permit the construction of a logical structure which models the failure modes of a system.

6.2.3.3 Fault sequences with individual frequencies have been generated using event tree analysis (ETA). Event tree have been developed to systematically identify the sequence of development of ultimate hazardous events, such as flash fire and pool fire, after an initial fuel leakage incident. The analysis has considered all the safety and operational controls used by AAHK to prevent system failures, and the assumptions on possible successful emergency isolation actions. Reference has been made to the previous EIA studies when determining the methodology, assumptions and parameters for the assessment.

6.2.3.4 All the estimated event frequencies have been inputted into the FTA using the Fault Tree+ (Ver. 11) program, and ETA has been adopted to determine the possible outcomes from the identified scenarios and to estimate the hazard frequencies. The updated hazard rates have been inputted into the RiskTool model to evaluate the overall individual risk and societal risk.

6.2.4 Consequence Modelling

6.2.4.1 Consequence analysis has been undertaken to determine the size of leakage of jet fuel, airside vehicle fuel (gasoline and diesel) under each of the identified scenarios and the corresponding safety risk to the working staff and travellers has also been assessed. The software PHAST has been used for the consequence modelling for vehicle fuel, while the software PoolFire6 thermal radiation model has been used for the consequence modeling for jet fuel pool fire. The aviation fuel system comprises submarine supply pipelines to the airport tank farm storage tank. The aviation fuel hydrant pumps draw from these tanks to supply the fuel hydrants which comprise an underground pipe network to the new apron and hydrant pit valves. When jet fuel is released from the hydrant system and should the unlikely event of immediate ignition occur, it will cause flash fire with subsequent pool fire ^[2]. If it is a delayed ignition, pool fire will happen for unconfined spillage while bund fire will happen if it occurs inside bund wall. Besides the jet fuel, petrol will be stored in the new airside vehicle filling station. Release of petrol from road tanker / flexible delivery hose with immediate ignition will cause pool fire while flash fire will happen if there is a delayed ignition. As a result, the following consequence modelling will be applied:

· Jet fuel leakage from submarine pipeline leading to pool fire on sea surface;

· Jet fuel leakage from underground pipeline and hydrant system with immediate ignition leading to flash fire with subsequent pool fire;

· Jet fuel leakage from underground pipeline and hydrant system with delayed ignition leading to pool fire;

· Jet fuel leakage from hydrant pump in AFTF leading to bund / pool fire;

· Immediate ignition of petrol leading to pool fire; and

· Delayed ignition of petrol leading to flash fire.

6.2.5 Risk Summation

6.2.5.1 The risk summation has been carried out by using the RiskTool program where it was used to generate both the individual risk contour and societal risk in the form of F-N curve. With reference to the ‘Requirements for Hazard to Life Assessment’ as specified in Appendix B of the EIA Study Brief, the following three scenarios have been assessed:

i. Risk due to the construction works near the existing aviation fuel pipelines and storage facilities;

ii. Risk due to the operation of new aviation fuel pipelines (submarine and underground) and new fuel hydrant systems for aircraft refuelling operation at the new aircraft stands in the airport expansion area; and

iii. Risk due to the operation of new facilities for storage of dangerous goods (DG) (i.e. fuel for airside vehicle/ground services equipment)

6.2.6 Recommended Safety Measures

6.2.6.1 Safety measures have been identified during the HAZID workshop and cost benefit analysis would be undertaken if the risk level falls into ALARP region.

6.3 Existing Aviation Supply and Distribution System

6.3.1 Supply of Jet Fuel to Aviation Fuel Tank Farm

6.3.1.1 Since the opening of the Tuen Mun permanent aviation fuel facility (PAFF) in 2010, PAFF becomes a new receiving and storage facility to accommodate the delivery vessels for unloading jet fuel into the fuel storage tanks. The PAFF has been assessed in a separate approved EIA study (EIA-127/2006) with a thorough hazard to life assessment meeting all statutory requirements. The PAFF is connected to the receiving facility in Sha Chau via twin 500 mm diameter submarine pipelines from where fuel is transferred to the aviation fuel tank farm on HKIA via existing pipeline connections. The PAFF provides a storage capacity of 388,000 m³, which is sufficient to meet the needs of the expanded airport operation.

6.3.1.2 The total length of the existing pipelines connecting Sha Chau and airport island is approximately 6 km, of which 3 km is located below the sea bed within the Sha Chau and Lung Kwu Chau Marine Park. The pipelines are buried approximately 6 m below seabed for the section connecting to the airport and 10 m below seabed for the section away from the airport to provide adequate protection from possible vessels and anchors damages. The submarine pipelines rise to the surface level at the HKIA seawall and connect to the inlets of the underground fuel pipelines inside the boundary of the airport. The existing pipeline landing point at the airport island is located at the seawall adjacent to the North Perimeter Road near the northwest tip of the existing North Runway as shown in Figure 6‑2.

Figure 6‑2: Layout of Existing Submarine Fuel Pipelines (Dotted Line in Orange Colour)

6.3.1.3 The underground pipelines are 3 m below surface and they start at the western end of the North Runway and run alongside the North Perimeter Road and South Perimeter Road before arriving at the on-airport aviation fuel tank farm.

6.3.2 Aviation Fuel Tank Farm

6.3.2.1 Inside the tank farm, there are 12 cylindrical steel storage tanks with conical roofs. They have a diameter ranging from 18 m to 26 m, with a total storage capacity of 223,000 m³. The tanks are operated at atmospheric pressure.

6.3.2.2 When the fuel is transferred from the receiving facility in Sha Chau to the on-airport tank farm, it will be quarantined for 24 hours. During which fuel sample is drawn for quality check. When the fuel quality is confirmed, it is ready for use.

6.3.2.3 The fuel tanks are connected to the hydrant network with auto-controlled hydrant pumps each rated at 330 m³/hr. Each pump is fitted with a filter to separate water from the fuel. The pumps deliver the fuel via the hydrant pipeworks (i.e. ring main) to each hydrant pit at a design pressure of 10 to 11 bar. Currently, there are 13 hydrant pumps in the tank farm and an additional hydrant pump will be installed under the on-going western apron development works (Contract P546). Expansion or relocation of the aviation fuel tanks will not be required as part of the airport expansion works.

6.3.3 Existing Hydrant System (Ring Main)

6.3.3.1 The ring main comprises generally of 24 inch diameter mild-steel pipework and it extends to various hydrant fuelling points located at strategic points around the apron. A programmable logic controller (PLC) located in the fuel farm operation building controls the system. The amount of fuel supplied from the tank farm to the hydrant systems varies to meet the airside demand.

6.3.3.2 At each hydrant fuelling point, there is a hydrant pit which is sunk into the ground. The pit contains riser pipework and a pit valve. A hydrant dispenser vehicle provides fuel transfer from the hydrant fuelling point into the aircraft’s fuel tanks during fuelling operation. A typical hydrant fuelling system is shown in Figure 6‑3.

Figure 6‑3: Typical Hydrant Fuelling System ^[10]

6.3.4 Hydrant Pit

6.3.4.1 Hydrant pits are sunk into the ground and located around apron at different strategic locations for aircraft refuelling. Each hydrant pit contains a pit valve which allows the connection between a hydrant dispenser vehicle and the ring main. The pit valve comprises an isolation valve, a pilot device and an outlet adapter. A typical pit valve is shown in Figure 6‑4.

6.3.4.2 The isolation valve is located at the inlet of the pit valve which is normally closed to stop the fuel from releasing out of the ring main. The isolation valve can be opened under the control of the lanyard operated pilot device. At the outlet, there is an outlet adapter where a hydrant inlet coupler attaches with. The outlet adapter is equipped with a poppet valve which closes the pit valve when the poppet valve on the inlet coupler is closed.

Figure 6‑4: Schematic of Pit Valve ^[2]

6.3.5 Hydrant Dispenser

6.3.5.1 Hydrant dispenser is a vehicle which provides fuel transfer from the hydrant pit to the fuel tank of an aircraft (refer to Photo 6‑1). The vehicle is equipped with an intake hose and two delivery hoses. The intake hose is connected to the pit valve while the delivery hoses connect to aircraft fuel valve (refer to Photo 6‑2). When all the hoses are properly connected, the operator carries out a final check of the quality of the fuel using commercial water detector (refer to Photo 6‑3). The operator then follows the instruction from flight crew and delivers the required amount of fuel to the aircraft. The vehicle also contains a dead-man switch which has to be depressed to start the fuelling process. The switch has to be depressed continuously and a built in timer has to be reset at intervals or the valve will be closed automatically.

6.4 Existing Safety Features

6.4.1.1 As jet fuel is a flammable liquid and the fuelling operation could result in hazardous events if performed incorrectly, therefore, safety provisions are incorporated in the design of the hydrant system and safety procedures are enforced to reduce the risk of the operation.

6.4.2 Leak Detection System

6.4.2.1 A leak detection system is installed to monitor the pressure and temperature of the jet fuel in the hydrant system. A monthly check of any leakage in the hydrant system is carried out using the detection system.

6.4.3 Emergency Fuel Shutdown System

6.4.3.1 Emergency fuel shutdown system initiated by pressing the emergency shutdown button (ESB) is provided under the high mast light post nearest to each of the hydrant pit as shown in Photo 6‑4. Activation of the ESB closes the hydrant isolation valve located in the fuel farm and stops all hydrant fuel supply pumps. An audible and visual alarm is indicated on the fuel farm control panel. The design of the emergency shutdown system is fail-safe, if there is accidental damage to any part of the cabling, or if an open circuit failure occurred, the safety system will be activated.

6.4.4 Dual Pilot Device/Lanyard

6.4.4.1 The dual pilot device provides a method for manually and pneumatically operating the pit valve, which closes the main isolation valve located in the lower half of the pit valve. The pilot device can be opened or closed manually by operating the deadman switch of hydrant dispenser, or remotely by pulling on the lever via a steel cable type lanyard (shown in Photo 6‑5). By releasing the deadman switch or manually pulling the lanyard, it operates the pilot valve which in turn closes the hydrant pit isolation valve within 2-5 seconds, thus stopping fuel from leaking out.

6.4.5 Dead-man Switch

6.4.5.1 The deadman switch operates the valves located inside the hydrant pit valve and hydrant coupler. This system is operated by a hand-held manual control which the fuelling operator grips in order to allow fuel to pass through the dispenser and into the aircraft, as shown in Photo 6‑6. Releasing the deadman switch causes the pneumatic valve to close thus stopping the fuel flow. To protect against inadvertent use of deadman control by jamming the hand controller, a built in timer is fitted to alert the operator to release and re-close the switch at predetermined period, failing which the fuel flow stops automatically. This safety provision ensures the operator is monitoring the fuel operation at all time and can respond immediately to any fuel leakage incident.

6.4.6 Brake Interlock System for Hydrant Dispenser Vehicle

6.4.6.1 The vehicle brake is tested before entering the aircraft parking stand and the brake is an integral part of an interlock system. The interlock system applies the vehicle brakes when any of the following occur:

· A pressure fuelling nozzle is removed from its stowage;

· The intake hose is being lowered;

· The intake coupler is removed from its stowage;

· The platform is in other than the fully down position; or

· The power take-off (PTO) mechanism is engaged. The PTO drives the hydraulic pump which powers the elevating platform, the hose reel rewind system and the dump tank emptying system pump.

6.4.7 Warning Flag

6.4.7.1 A four wing high visibility flag is placed next to hydrant pit when a hydrant coupler is connected to the pit valve, as shown in Photo 6‑7. The flag serves as a warning signal to other drivers that the hydrant pit is engaged in a fuelling operation and all vehicles is kept in a safe distance away from the pit.

6.4.8 Illumination at Pit Valve and Inlet Hose

6.4.8.1 During the fuelling operation at night, the hydrant pit valve and inlet hose is illuminated. Light reflective collars are attached to the inlet hose at approximately 1 m intervals.

6.4.9 Speed Control

6.4.9.1 The airport speed limit of 35 km/h at the apron is imposed. All traffic signs and signal are obeyed.

6.4.10 No Smoking Policy / Mobile Phone Policy

6.4.10.1 Operators are not allowed to smoke in the tank farm and during fuelling operation. “No smoking” signs is prominently displayed near the aircraft and fuelling vehicles. Currently, smoking is prohibited in all airside restricted areas.

6.4.10.2 Mobile phone is not allowed in the tank farm and apron areas.

6.4.11 Fire Extinguisher

6.4.11.1 Each hydrant dispenser vehicle is equipped with two fire extinguishers as shown in Photo 6‑8 which provide the operator an effective means to put out a small fire at the scene.

6.4.12 Cathodic Protection

6.4.12.1 Cathodic protection is a technique to protect the fuel pipeline from corrosion by connecting the pipeline with the cathodic protection transformer rectifiers. The cathodic protection transformer-rectifiers convert the AC power supply to a DC output for the impressed current cathodic protection systems.

Photo 6‑1: Hydrant Dispenser Vehicle in HKIA Photo 6‑2: Delivery Hose to Aircraft Fuel Tank

Photo 6‑3: Quality control Sampling Equipment	Phot o 6‑4: Emergency Shut Down System
Photo 6‑5: Hydrant Pit Valve and Lanyard and air hose connecting the dual pilot valve	Pho to 6‑6: Dead-man Switch
Photo 6‑7: Warning Flag	Photo 6‑8: Fire Extinguisher

6.5 Description of Refuelling Operation Practice

6.5.1.1 All airlines operating in HKIA normally have a representative overseeing the ramp operations during aircraft turnarounds, whom is either a direct employee of the airline or their delegate, usually referred to as the ramp coordinator. The ramp coordinator oversees all the ramp activities required to adequately service any aircraft, and a range of other coordination and liaison activities for example chasing up service providers who are late and acting as an on-scene liaison person to resolve all aircraft servicing coordination issues.

6.5.1.2 All ramp activities are coordinated as efficiently as possible given the high demand for parking stands, Service provision and related resources management is done by a range of key service providers including the following:

i. Ramp Handling Operators are responsible for cargo / baggage loading, offloading and delivery to and from the BHS and supply and operation of airbridge and passenger steps;

ii. Line Maintenance Operators are responsible for aircraft line maintenance as well as aircraft cabin-cleaning;

iii. Catering Operators are responsible for supplying food and beverages, provision of newspaper and magazines services, etc.; and

iv. Into-plane Refuelling Operators are responsible for refuelling the aircraft.

6.5.1.3 All ramp operations rely on the flight schedule, which is released by airlines and includes the scheduled departure time and scheduled arrival times. For efficient real time handling, especially short turnaround flights, estimated or actual arrival times are essential for the ramp companies to allocate resources in an efficient and effective manner. Ramp handling companies have access to the landing sequence display from the Civil Aviation Department (CAD) via Airport Authority Hong Kong (AAHK) and information available includes accurate flight data including estimated arrival time, actual arrival time, and estimated departure time. In the near future, such provision of information is to be further enhanced through the adoption of an Airport Collaborative Decision Making (ACDM) system, which will also incorporate the individual completion times for different ramp activities to improve surveillance of the flight turnaround activities and allow more accurate calculation of estimated departure times.

6.5.1.4 Aircraft turnaround ramp activities are pre-planned with well established lines of communication in place between the various aircraft servicing companies, for example covering the servicing order for each aircraft.

6.5.1.5 AAHK publishes an Airport Operations Manual - Airfield Operation (AOM) and ramp companies can access this via electronic means. The AOM stipulates standard ramp handling procedures, these being a statutory requirement for fulfilment of CAD aerodrome licensing requirements. Part of the Manual covers expectations and protocols required for aircraft refuelling.

6.5.1.6 AAHK’s Airfield Department has an oversight role for ramp activities and each company operating on the ramp must adopt Standard Operating Procedures governing the safe provision of services they provide. The Airfield Department conducts regular ramp audits on the activities of ramp service providers.

6.5.1.7 For aircraft refuelling operations, there are clear guidelines on aircraft stand arrangements during fuelling activity, which vary depending on aircraft type and size. In general, if aircraft refuelling with passengers on-board is necessary, any concurrent passenger embarkation and disembarkation must take place on the port side of the aircraft with refuelling usually to take place on the starboard side wing refuelling point.

6.5.1.8 AAHK’s Airfield Department chairs numerous forums with the remit to maintain and safeguard operational safety including the Ramp Handling Operations Safety Committee, the Airfield Operation & Safety Committee etc. Ramp safety related issues are disseminated in those forums with the goal to maintain the safest possible safe operating environment.

6.5.1.9 CAD is the Aerodrome Licensing Authority and AAHK as the airport operator has to ensure that a range of well defined licensing requirements as specified by CAD are achieved. In order to renew the aerodrome license, CAD must ascertain that AAHK operates the aerodrome in a way that complies with international safety and other standards. A key component covers the safe supply and delivery of fuel to aircraft. AAHK undertakes regular internal safety audits and inspections of the range of ramp operators (including the aircraft fuelling component) so as to ensure licensing requirements can be maintained.

6.6 General Description of the Project

6.6.1 Diversion of Submarine Pipelines

6.6.1.1 The third runway land formation will require ground improvement works to be carried out in the seabed within the third runway land formation footprint where the existing aviation fuel pipelines are located. The preferred option is the diversion of submarine fuel pipeline by horizontal directional drill (HDD) method, which is the blue line as shown in Figure 6‑5 below.

Figure 6‑5: Alignment of the Diverted Submarine Fuel Pipeline

Diversion of submarine fuel pipeline by horizontal directional drill (HDD) method

6.6.1.2 This preferred option involves installation of the two diverted 500 mm diameter (DN500) subsea fuel pipelines from the west of the airport island to the Sha Chau Island by HDD method (see Figure 6‑6) to replace the existing subsea fuel pipelines that conflicts with the third runway land formation from Sha Chau to the airport island. The possible diverted twin subsea fuel pipelines will be a direct route from the western side of the existing north runway to Sha Chau Island.

6.6.1.3 The horizontal alignment of the diverted undersea aviation fuel pipelines was selected to provide the shortest length for the horizontal drilling works and minimise the extent of the connection works required to the existing aviation fuel pipelines. The horizontal alignment starts from a HDD launching site located at a seawater pump house reserve area near the western end of the existing North Runway adjacent to the Vault D extension building. This launching site was selected as the drilling and support equipment that would be used at the site (maximum height of the drilling and support equipment will be approximately 10 m) will be below the airport height restriction requirements and the site is adjacent to the North Perimeter Road and accessible to the existing land aviation fuel pipelines where the connection works to the existing aviation fuel pipelines can be carried out in a controlled manner. The pipeline routing from the HDD launching shaft to the connection point with the existing land aviation fuel pipelines is relatively short and free of obstruction. A valve chamber will be provided for isolation and leak detection.

Figure 6‑6: Example of HDD Construction Method

6.6.2 Construction Activities in the Vicinity of the Existing Fuel Network

6.6.2.1 Airside road tunnels will be built beneath the existing North Runway to connect the new concourse / terminal to the proposed new cargo base, midfield, and existing Terminal 1 (T1) as shown in Figure 6‑7. The proposed road tunnel concept currently consists of four lane tunnels (two lanes in either direct) to allow overtaking. The two sets of lanes are separated by a central divider to accommodate a pedestrian escape tunnel. Above the escape tunnel there is a void to allow for smoke extraction services.

Figure 6‑7: Preliminary Airside Tunnel Arrangement

6.6.2.2 The road tunnel (in blue line as shown in Figure 6‑7) will be built by cut and cover method and the construction work site will be close to the aircraft parking stands at T1 and Midfield. The construction works could potentially affect the existing underground fuel pipeline (pink line as shown in Figure 6‑7) and fuel hydrant system which remain in operation during construction period. Although the hydrant system in the Midfield (orange line as shown in Figure 6‑7), will be temporarily shut down during the tunnel construction work, potential construction-related impact could not be ruled out completely.

6.6.3 Construction Activities in Vicinity to AFSC Tank Farm

6.6.3.1 The existing tank farm at the HKIA currently has 13 hydrant pumps giving a total pumping capacity of 71,500 L/min. An additional hydrant pump, including electrical switchgear, building extension and fire services extension, will be installed under the on-going western apron development. In order to meet the projected number of departures in 2030, the current peak flows for the aviation fuel supply has to increase to 102,000 L/min. This would require additional pumps to be installed at the existing tank farm. The current design is to provide an additional six pumps at the reserved area beside the existing pumps. The installation of new pumps will require the modification of connecting valves and pipeworks, an additional 1,500 kVA transformer for supplying power to the new electric motors, additions of PLC racks to suit the SCADA requirement and fire service system extension. Fuel tanks and other major equipment and facilities will be unaffected.

Photo 6‑9: Existing Fuel Hydrant Filter Water Separator (with pumps behind – see Photo 6‑13)

Photo 6‑10: Reserved Area for New Hydrant Pumps

6.6.4 New Fuel Hydrant System

6.6.4.1 A preliminary design of the aviation fuel supply (hydrant) system has been conducted and in the design, the peak jet fuel delivery capacity of the system will be increased from 71,500 to 102,000 L/min. In order to meet the increase in the peak flow, it was suggested that six new pumps to be installed with each one having a delivery capacity of 5,500 L/min with 122 m total head ^[22]. Both the existing and future hydrant system networks are shown in Figure 6‑8. The existing network, which is shown as pink line, serves to supply jet fuel to aprons at the T1 concourse and hydrant pits along South Runway Road. The existing network will then be extended to the aprons at the new concourse located on the third runway using DN600 pipes and it is shown as purple line. Another new supply pipeline (also DN600), which is shown as orange line, will also be constructed to connect between AFTF and the Midfield as part of the existing Midfield development (which will be in place before commencement of the project).

6.6.4.2 In the current study, only the expansion of the hydrant system for the 3RS (i.e. purple line) will be considered and it is assumed that the engineering and procedural safeguards currently in place for the existing hydrant system will be equally applied in the expansion of the hydrant system.

Figure 6‑8: Aviation Fuel Hydrant System Layout

6.6.5 Fuelling Operations at Apron

6.6.5.1 Aviation fuel from the tank farm is distributed to aircraft stands at the passenger apron and cargo apron via the aviation fuel hydrant system. Fuel supply operations are performed by Aviation Fuel Supply Company (AFSC) according to the procedures and precautions as stipulated in the Aviation Fuel at Aerodromes, CAD748 Aircraft Fuelling and Fuel Installation Management.

6.6.5.2 Aircraft fuelling services are currently provided by two franchisees, AFSC Refuelling and Worldwide Flight Services (WFS). All aircraft parking stands in the passenger apron and cargo apron are equipped with underground fuel hydrants to facilitate refuelling for a full range of aircraft types. All fuelling operations are carried out according to the procedures and precautions stipulated in Aircraft Fuelling: Fire Prevention and Safety Measures, CAD748.

6.6.5.3 The aircraft fuelling operation manager will appoint a “fuelling in-charge” to supervise the fuelling procedures, coordinate with the fuelling operator and handle any irregular situations. The fuelling in-charge will ensure:

· The aircraft wheels are adequately chocked;

· A fuelling zone extending not less than 6 m radially from the filling and venting points on the aircraft and from the hydrant valve in use, is established; and

· Fuelling should not take place if brakes have been excessively heated during landing, until brakes have cooled sufficiently to reduce potential fire danger.

6.6.5.4 As jet fuel is prone to static electricity generation, the aircraft, fuelling vehicle, hose coupling or nozzle, filters, funnels or any other appliance through which fuel passes, shall effectively be bonded to each other before filler caps are removed, and not be disconnected until the filler caps have been replaced.

6.6.5.5 Ignition sources are strictly controlled within the fuelling zone. Personnel engaged in fuelling do not carry lighters or other means of ignition, or wear foot-wear with exposed iron or steel studs. Ground power units are positioned at least 6 m from the aircraft fuel coupling and any venting points, hydrant valves and other fuelling equipment. All hand torches and inspection lamps and their cable connections used within the fuelling zone are either ‘intrinsically safe’ or suitably classified for use in area where petroleum vapours may be present. Mobile phone or TMR cannot be used in the vicinity of the refuelling truck during the refuelling operation.

6.6.5.6 Propulsion engines are not running during fuelling operation. The fuelling vehicle and equipment shall be positioned so that they do not obstruct the escape route of persons from the aircraft in an emergency, and allow clear access to aircraft for rescue and fire fighting. Sufficient clearance shall be maintained between the fuelling equipment and the aircraft wing as fuel is transferred and they are not positioned beneath the wing vents. The fuelling in-charge remains in the vicinity of the aircraft and shall ensure the correct positioning of service equipment and parking of fuelling vehicles.

6.6.5.7 The airline or aircraft operator ensures that all personnel working on, inside or in the immediate vicinity of the aircraft are made aware that fuelling is taking place. The fuelling operation will display a red flag within the fuel hydrant point to alert awareness of other personnel servicing in the vicinity.

6.6.5.8 When passengers remain on board during fuelling operations, additional precautions are taken. Prior notification should be made to Apron Control Centre (ACC) and the pilot in command of the aircraft is informed of the fuelling operation. The areas below the aircraft doors is cleared to enable the deployment of emergency chutes whenever required and a free and unobstructed passenger escape route is maintained from the airbridges, aircraft stands or emergency chutes to a safe area.

6.6.5.9 The on-board illuminated “NO SMOKING” and “EXIT” signs are switched on, and announcements are made to advise passengers of fuelling, no smoking requirement, not to fasten seat belts and restriction on operating electrical equipment or producing source of ignition. The cabin aisles and the emergency exit areas is kept clear of obstructions and the same number of airbridges or aircraft stands as normally used for passenger disembarkation are positioned at the doors, which are kept opened. A member of the cabin staff must be stationed at each door to direct emergency evacuation as required throughout the period of fuelling operation.

6.6.5.10 In the event of fuel spillage, the fuelling operator will release the deadman switch, pull the lanyard or activate the ESD button. He will then inform the ACC of the incident, and in turn the ACC will notify Airport Fire Contingent to dispatch fire appliances to standby. An Airfield Officer will be deployed to investigate the spillage, and the fuelling operator will immediately respond to contain and remove the spilt fuel.

6.6.5.11 Details of the Airport Operations Manual aircraft refuelling safety procedures for HKIA are provided in Appendix 6.2 with details of emergency response procedures and training requirements provided in Appendix 6.3. In addition, safety requirements of the Hong Kong Civil Aviation Department relating to aircraft refuelling are specified in CAD 748, “Aircraft Fuelling and Fuel Installation Management” with key elements provided in Appendix 6.4.

6.6.6 New Airside Vehicle Fuelling Station

6.6.6.1 Based on the initial scheme design, it is identified that among the proposed facilities to be provided, there will be an airside vehicle filling station to be provided in the eastern support area of the expansion area ^[22].

6.6.6.2 There are currently three airside vehicle fuel filling stations operated by Sinopec (Hong Kong) Limited serving the airside vehicles and ground equipment. All the fuel filling stations have underground tanks storing gasoline and diesel. Only the airside vehicle fuel filling station No.2 has LPG storage and filling facility. In addition, there are airside vehicle filling stations serving only for the Chek Lap Kok Fire Station and Airport Police Station. The storage capacity of the existing filling stations are summarised below:

· Station 1: Diesel (2 tanks of 71,800 and 60,312 litres) and Petrol (1 tank of 11,488 litres)

· Station 2: Diesel (2 tanks of 71,800 and 60,312 litres), Petrol (1 tank of 11,488 litres) and LPG (2 tanks of 12,000 litres each)

· Station 3: Diesel (2 tanks of 71,800 and 60,312 litres) and Petrol (1 tank of 11,488 litres)

6.6.6.3 Details for the future airside vehicle filling station are yet to be developed and therefore it is assumed that the future station will be in similar size and capacity as the existing filling stations serving for gasoline/diesel filling operation for airside vehicles. Tentatively, the station can serve up to four small or two large vehicles at any one time ^[22] and additional LPG filling station will not be required for the project.

6.7 Information Relating to Aviation Fuel (Jet A-1)

6.7.1.1 Background research had been undertaken to review the information collected from public domain and the HKIA aviation fuel operator AFSC such as the jet fuel material safety data sheet, operation manual, incident reports and other relevant reports as listed in the Section 6.19. A meeting was also set up with the AFSC operation manager to discuss and review the existing fuel operation and apparatus in HKIA. A site visit of the hydrant system was conducted after the meeting to observe how the fuelling operation is conducted.

6.7.2 Physical Properties of Jet A-1

6.7.2.1 Jet A-1 is the jet fuel used in the HKIA and it is stored in the aviation fuel tank farm maintained by the AFSC. As the tank farm is located at Scenic Road which is far away from the passenger stands and cargo stands where the aircraft fuelling operation taking place, an aviation fuel hydrant system is installed to transfer the fuel from the tank farm to various fuelling points.

6.7.2.2 Jet A-1 is kerosene based and is generated as one of the distillated products in fractional distillation of crude oil, which then undergoes other processes, such as de-sulphurisation, to enhance its purity required for aircraft engines. The physical properties of Jet A-1 used in HKIA are shown in Table 6‑1 below.

Table 6‑1: Physical Properties of Jet A-1 ^[1]

Property	Value
Physical State	Mobile liquid at ambient temperature
Appearance	Clear water white/straw
Odour	Characteristic
Liquid Density	775-840 kg/m³ @ 15˚C
Initial Boiling Point	150 ˚C
Final Boiling Point	<300 ˚C
Minimum Flash Point	>38 ˚C
Flammable Limits	1-6 % Vol
Auto-flammability	220 ˚C
Vapour Pressure	<0.1 kPa @ 20˚C
Viscosity	1 to 2 cSt @ 40˚C

Table 6‑2: Other Physical Properties of Typical Jet A-1 ^[^2]

Property	Value
Burning Rate	0.053 kg/m²/s
Pool Rate of Flame Spread	<0.5 m/s
Minimum Ignition Energy	0.2 mJ
Latent Heat of Vaporization	291 kJ/kg
Specific Heat	2.19 kJ/kg

6.7.3 Hazards Associated with Jet A-1

6.7.3.1 Jet A-1 is a flammable liquid with a low vapour pressure at ambient temperature, this makes the liquid less volatile and it evaporates slowly in case of fuel leakage. Also, the fuel has a flash point greater than the ambient temperature in Hong Kong. This means that the fuel will not give off flammable vapour at a concentration sufficient to cause ignition. A significant heat source is, therefore, required to ignite the fuel.

6.7.3.2 The low electrical conductivity of the fuel makes it possible for static electricity to be generated and for charges to be accumulated. The degree of static charge accumulated in the fuel depends upon the following factors:

· The amount and type of residual impurities, such as dissolved water;

· The linear velocity through piping systems;

· The presence of filter, and

· The opportunity for the fuel to relax for a period of time to allow any charge generated to dissipate safely to earth.

6.7.3.3 In order to reduce the accumulated amount of static electricity, antistatic additives are added to the fuel. This works by enhancing the conductivity of the fuel in order to shorten the time required for dissipating the static charge safely to earth.

6.7.3.4 Jet A-1 is classified for supply purpose as harmful as a result of the aspiration hazard and irritation to the skin. Toxicity following a single exposure to high levels (orally, dermally or by inhalation) of Jet A-1 is of low order, however exposure to high vapour concentration can lead to nausea, headache and dizziness. Accidental ingestion can lead to chemical burning of the mouth. Ingestion can lead to vomiting and aspiration into the lungs which can result in chemical pneumonitis which can be fatal.

6.7.3.5 Prolonged and repeated skin contact can lead to defatting of the skin, drying, cracking and dermatitis.

6.8 Information Relating to Airside Vehicle Fuel

6.8.1 Physical Properties of Airside Vehicle Fuel

6.8.1.1 Gasoline is a liquid mixture of hydrocarbon molecule and it is more volatile than jet fuel and diesel oil. The exact physical properties of the gasoline depend on its composition which varies from different products. Generally speaking, gasoline contains hydrocarbon with molecular weight between C4 to C12 with the boiling point in the range of 30 to 210 ^oC. Since the flash point of gasoline is well below the normal ambient temperature in Hong Kong, it will give out flammable gas into the atmosphere.

6.8.1.2 Compared with gasoline, diesel is less volatile due to its higher molecular weight (C13 to C25) with a high boiling point between 220 to 350 ⁰C and a high flash point around 76 ⁰C.

6.8.2 Hazards Associated with Airside Vehicle Fuel

6.8.2.1 Gasoline is a highly flammable liquid which is classified as Category 5 Class 1 Dangerous Goods in Hong Kong ^[3]. It can give off vapour even at very low temperature. Since the vapour is heavier than air, it does not disperse easily and it tends to sink to the lowest possible level and may collect in tanks, cavities, drains, pits or other enclosed area, where there is little air movement.

6.8.2.2 When gasoline is accidentally released outside a storage tank, it results in a pool fire if it is ignited immediately after release. However, if an ignition source is not immediately available, gasoline liquid will vaporize and mix with air to form a gas plume with a lower flammability limit and upper flammability limit of 1 % and 7 % respectively. Flash fire will happen if there is a delayed ignition of the flammable gas plume in an un-confined environment while a semi-confined/enclosed environment will result in vapour cloud explosion.

6.8.2.3 Diesel on the other hand does not vaporise as readily as gasoline and it is less flammable due to its high boiling and flash point.

6.8.2.4 Gasoline / diesel can float on the surface of water and may travel long distances to cause danger away from the place where it escaped.

6.8.2.5 Gasoline / diesel vapour can be harmful if inhaled to cause drowsiness and dizziness. It also irritates to both eyes and skin. Lung damage may happen if it is swallowed.

6.9 Hazard Identification

6.9.1.1 By reviewing historical aviation fuel spillage incidents in both HKIA and worldwide airports, it can provide important information of the potential failure events and their causes that could occur in the fuel hydrant system. The review together with an assessment of the design of the hydrant system in HKIA can provide a comprehensive identification of potential failure events of the system. In this section, the worldwide and local fuel spillage incidents will be discussed.

6.9.2 Jet Fuel Spillage Incidents in Worldwide Airports

6.9.2.1 A literature search has been conducted to identify incidents involving jet fuel around the world and a summary is provided in Table 6‑3 below. The major sources of information include fuel spillage incident record provided by AFSC ^[3-5], Aviation Safety Network ^[25], Loss Prevention in Process Industries ^[12] and WS Atkins internal library ^[2].

Table 6‑3: Worldwide Historical Aviation Fuel Spillage Incident Records from 1982 to 2012

No.	Year	Location	Operation	Incident Description
1	1982	UK	Fuelling	Aircraft was being refuelled to ‘full tanks’ with a suspect contents gauge in one tank, resulted in spillage.
2	1986	West Indies	Hydrant Fuelling	Poor maintenance. Inlet hose burst at 125 psig. Spilt onto engine resulting in a fire. Hose in bad condition, noticed visually before the failure.
3	1988	USA	Fuelling	Fuel was leaked from an aircraft, the cause was thought to be a leaky fuel valve, a broken fuel gauge or overfilled tanks. 2,200 litres was spilt.
4	1989	UK	Hydrant Fuelling	Human error with a tug striking fuel hydrant causing fuel leak
5	1992	Moskva-Domodedovo Airport (Russia)	Hydrant Fuelling	A cigarette dropped during a refuelling operation caused a fire. The aircraft was broken up in March 1993
6	1993	Nigeria	Hydrant Fuelling	Poor maintenance, dolly wheels had been fitted to a pit coupler. Not re-assembled correctly (wrong bolts used, too short). An estimated 17,000 litres of Jet A-1 spilt.
7	1995	New Zealand	Hydrant Fuelling	Poor maintenance, dolly wheels had been fitted to a pit coupler. Not re-assembled correctly (wrong bolts used, too short). Inexperienced maintenance technician. 2,000 to 3,000 litres spilt.
8	1995	UK	Hydrant Fuelling	Fuelling had been completed and pit valve had been closed with lanyard pulled. A tug reversed over pit, causing a crush to inlet coupler from the hydrant. No spill occurred
9	1995	Puerto Rico	Hydrant Fuelling	Failure of pilot valve
10	1996	UK	Hydrant Fuelling	Inlet coupler, problem with claws bending under load due to grade of material being used. The seal may have had a nick in it and a spray of fuel resulted.
11	1997	Australia	Hydrant Fuelling	A tug pulling a low profile dolly was driven to pass between the dispenser and an engine. The corner of the trailing cargo dolly struck a coupler. The impact force completely destroyed the pit valve. Operation of ESB stopped flow. 7,500 litres of Jet A-1 spilt.
12	1997	UK	Aircraft Maintenance	Self-sealing mechanism failed to close when a booster pump was removed from a fuel tank. 2,500 L fuel was spilt
13	1997	UK	Hydrant Fuelling	Pit valve was seriously damaged due to a reversing tug. Lanyard was pulled in time to stop fuel spilling
14	1997	UK	Hydrant Fuelling	Baggage conveyor truck reversed into fuel hydrant. Inlet coupler sheared off at the flange between the pressure regulator body and the coupling. Lanyard trapped under hydrant pit lid which was under the rear of the baggage truck. The fuel spillage is stopped by emergency shutdown button. 6,500 litres of fuel was spilt.
15	1998	UK	Hydrant Fuelling	Coupler seriously hit by reversing loader. Pit hydrant poppet closed stopping major flow. 15 litres spilt.
16	1998	UK	Hydrant Fuelling	Operating pressure during aircraft fuelling is higher than the design pressure, aluminium pipework on hydrant dispenser split. 1,000 litres of fuel had been spilt before lanyard was pulled
17	1998	UK	Aircraft Maintenance on a stand	Self-sealing mechanism failed to close when a low pressure pump was removed from a fuel tank. The other contributory factor was that the maintenance technician failed to follow the correct maintenance procedure. 3,300 to 7,000 litres spilt.
18	1998	New Zealand	Fuelling	Extensive fuel leak observed aircraft overflow. No ignition.
19	1998	Miami Airport, Florida	Fuelling	Fuel truck fire spread to a wing during fuelling.
20	2000	Minatitlan Airport (Mexico)	Hydrant Fuelling	Refuelling truck drove off whilst still connected to the aircraft, the hose ruptured and the fire ensued.
21	2001	Denver International Airport (USA)	Hydrant Fuelling	Based on the information provided by the National Transportation Board of the U.S., the fire started when the airplane was parked at the gate unloading passengers and being refuelled. The captain, first officer, a third pilot, 13 cabin crew members, and 10 passengers who were on board at the time of the accident, but were not injured. However, the ground service refueller was fatally injured because he was standing on the raised platform of the refuelling track (i.e. next to the aircraft tank valve under the aircraft wing) while refuelling was in progress. The overstress fracture of the airplane's refuelling adapter ring that resulted from the abnormal angular force applied to it. The applied angular force occurred due to the ground refueller inadequately positioning the hydrant fuel truck (in relation to the airplane), and his inattentiveness while lowering the refuelling lift platform, thus permitting the refuelling hose to become snagged and pulled at an angle. The fracture of the adapter ring during the refuelling led to the ignition of the pressurized (mist producing) spilled fuel and subsequent fire.
22	2003	Minneapolis-St. Paul International Airport (USA)	Hydrant Fuelling	A significant leak from the fuel pipeline system at a concourse, which released jet fuel to the sanitary sewer
23	2003	Emmonak Airport (USA)	Fuelling Transfer	Jet fuel was spilled during a fuel transfer from its tank farm
24	2006	OR Tambo International Airport (South Africa)	Hydrant Fuelling	Faulty gasket in a valve chamber in the hydrant fuelling system
25	2007	Oklahoma (USA)	Jet Fuel Transfer by Pipeline	On 14 July 2007, Explorer’s 28 inch interstate refined petroleum products pipeline rupture near Huntsville about 70 miles north of Houston and jet fuel spilled on to the surrounding area and into nearby Turkey Creek. This incident caused a serious environmental damage but did not claim any injury.
26	2008	Timco Aviation Services (USA)	Aircraft Maintenance	A fuel filter on an airline was being changed and a flap designed to contain the fuel became lodged against another piece of equipment. The fuel spill occurred when workers attempted to dislodge the equipment
27	2008	Philadelphia International Airport (USA)	Fuel Transfer	Jet fuel were spilled from an Atlantic Aviation aircraft onto the tarmac of the airport during a fuel transfer operation
28	2008	Chicogo-Midway Airport, IL (USA)	Fuel Storage	Fuselage puncture by a ground service vehicle.
29	2009	Pologi, Zaporizhya Region (Ukraine)	Refuelling Operations	Caught fire and burned during a refuelling operation.
30	2011	Bichevaya, Russia	Fuel Transfer	The An-2 biplane caught fire while being fuelled. Fuel was split, which caught fire due to static electricity.
31	2012	Milwaukee (USA)	Jet Fuel Transfer by Pipeline	2 mm hole of an underground jet fuel pipeline in the Mitchell International Airport caused a fuel spill in the creek near the airport. The incident caused a serious environmental damage but no injury resulted.
32	2012	Chicago (USA)	Jet Fuel Transfer by Pipeline	Pressure in the jet fuel pipeline exceeded an established maximum load for the aging line built in 1958. An estimated 42,000 gal. of jet fuel leaked from the 12 in. pipe 16 miles southwest of Chicago. The fuel flowed into a creek and caused a serious environmental damage, but no injury resulted in the incident.

6.9.3 Jet Fuel Spillage Incidents in HKIA

6.9.3.1 According to the information provided by AFSC, there were six fuel spillage incidents during aircraft refuelling operation recorded in the HKIA between 1998 and February 2013. Information from the incident reports are summarised below. All incidents only lead to minor spillage except for one case. All the spillage incidents did not result in fire.

6.9.3.2 [Case 1] On 6 September 2004, HKIA was affected by a thunderstorm and a tornado hit the runway and cargo apron. Amber / Red Lightning Warnings were issued by AAHK during the period. The strong wind blew a cargo loader away from its original position leading to a crash with the ground coupler of a hydrant dispenser. The whole hydrant system was stopped as the tank farm SCADA system received a fuel hydrant emergency shut-down (ESD) signal from Cargo Stand C12 which was also knocked down by the loader.

6.9.3.3 After the hydrant system was shut down, another ESD signal was received 44 seconds later from Cargo Stand C13. The signal was initiated by the operator of the hydrant dispenser who could not find the nearest ESD button at Cargo Stand C12 since it was already knocked down.

6.9.3.4 In this incident, a large amount of 15,000 litres of jet fuel spilled out from the ground coupler of the dispenser and this amount could be significantly reduced if the lanyard was used effectively by the aircraft refuelling operator. The lanyard was only pulled 7 minutes after a Tank Farm Operator arrived at the scene.

6.9.3.5 In addition of the fuel spillage, an airline staff was injured and the ESD post and switch, upper part of the pit valve and a pit box cover at C12 were damaged.

6.9.3.6 [Case 2] On 26 March 2006, an approximate of 150 litres of jet fuel was spilled into a pit box and 20 litres spilled on the apron ground. The spillage was discovered 4.5 minutes after the commencement of the fuelling and the operator released the dead-man switch and pulled the lanyard after the incident was observed. The incident occurred due to a piece of broken wave washer jamming between the contact surface of the hydrant pit valve and the hydrant intake coupler. Scratches on the nose seal and poppet of the intake coupler were also found after dismantling the intake coupler. It was reported with no injury and a 30 minutes delay of the concerned aircraft.

6.9.3.7 [Case 3] On 9 May 2006, a HAS tractor hit a hydrant intake coupler of a dispenser vehicle and the cause is due to careless driving. As the fuelling had been completed and pending for the confirmation of fuel load from the flight crew, there was only around 25 litres of jet fuel spilled from the broken fuel sensing hose into the hydrant pit box. The incident didn’t cause any injury and no contamination on the apron floor was observed.

6.9.3.8 [Case 4] On 2 June 2011, the fuelling operator drove the dispenser to parking stand for fuelling DHL Airline. He discovered that fuel had spilt from the hydrant pit cover when preparing to connect ground hose. It was reported to the tank farm operator and later found that this is due to defective pilot valve. The area of spill is about 4 m x 10 m. The hydrant pit resumed normal fuel supply after replacing the pilot valve with a new one. It was reported with no injury and a 30 minutes delay of the concerned aircraft.

6.9.3.9 [Case 5] On 19 August 2011, leakage occurred between the coupler of the connecting hose and the adaptor on the aircraft wing. It was spotted by the pilot during flight inspection and the fuelling operator was informed and immediately released the deadman switch. Approximately 2 litres of jet fuel spilt onto the apron ground. It was found that the leakage is due to defective gasket inside the coupler. It was reported with no injury.

6.9.3.10 [Case 6] On 24 January 2013, leakage from a hose nozzle occurred during the fuelling operation, the fuelling operator immediately stopped the refueling, and approximately 2 m x 2 m of fuel spill on apron ground. After the defective dispenser was driven back to workshop, it was checked by mechanic and found that the cause of spillage was due to the destruction of the “O” ring on the delivery nozzle. It was reported with no injury.

6.9.4 Identification of Failure Events from Historical Incidents

6.9.4.1 A total of 38 jet fuel spillage incidents were identified from Hong Kong and worldwide airports within the past 30 years and they are summarised in Table 6‑4 below. The most common cause is vehicle impact damage of hydrant coupler (i.e. careless driving) which accounts for 21.1 %. The second and third common causes are defective hydrant coupler and leakage in fuel transfer pipeworks which account for 15.8 % and 13.2 % respectively. The three causes have accounted for almost 50 % of all the identified incidents. This result will serve as a reference for the hazard identification.

Table 6‑4: Summary of Identified Jet Fuel Spillage Incidents

Spill Location	Cause of Event	Incident No.	Percentage
Aircraft	Faulty fuel valve, overflow	1, 3, 18	7.9 %
Aircraft	Poor maintenance of fuel filter	26	2.6 %
Aircraft	Fuselage damaged by service vehicle	28	2.6 %
Aircraft	Failure of self-sealing mechanism during maintenance	12, 17	5.3 %
Hydrant coupler	Hydrant dispenser drove off with connecting hose due to human error	20	2.6 %
Hydrant coupler	Fracture of adaptor ring, object jammed due to poor connection	21, Case 2	5.3 %
Hydrant coupler	Vehicle impact damage	4, 8, 11, 13, 14, 15, Case 1, Case 3	21.1 %
Hydrant coupler	Defective gasket / O-ring, poor maintenance	2, 6, 7, 10, Case 5, Case 6	15.8 %
Pit Valve	Faulty valve/ gasket	9, 24, Case 4	7.9 %
Dispenser	Pipework broken due to design error	16	2.6 %
-	Not Available / Non-identifiable	5, 19, 27, 29, 30	13.2 %
Hydrant system	Leakage in pipeworks	22, 23, 25, 31, 32	13.2 %

6.9.5 Construction and Operation Phasing

6.9.5.1 The project starts with advanced preparation works such as diversion of the existing submarine pipeline and power cable. After that, the construction and runway operation programme is divided into three phases. In Phase 1, land formation works will commence first before subsequent construction of the third runway, new taxiways and the new third runway concourse (TRC). Expansion of Terminal 2 (T2) will also be commenced. The existing two-runway system remains operational throughout this construction phase. Upon completion of the third runway and associated taxiways, Phase 2 will begin in which the existing North Runway will be closed for modification works, while construction activities for the TRC and aprons, vehicle tunnel and reconfiguration of T2 and landside works are ongoing. During this interim period, the existing South Runway and the new third runway will be operational. Upon completion of all essential infrastructure and facilities including the main TRC and aprons and expanded T2, the airport will operate under the three-runway system (Phase 3 of the programme), tentatively scheduled to commence by 2023. During Phase 3, all three runways will be operational while construction of the remaining facilities will continue until completion. A schematic diagram showing the phasing is given in Table 4.3.

6.9.5.2 Referring to Drawing No. MCL-P132-EIA-4-002 and MCL-P132-EIA-4-003 shown in Chapter 4 of this report, the construction activities to be carried out in the airside of the HKIA include the installation of Automated People Mover (APM), Baggage Handling System (BHS), underground road tunnel and modification of existing North Runway (i.e. centre runway in three runway system). Since both the APM and BHS do not pass through the existing airside of the HKIA, they will not affect the integrity of the existing hydrant system and airside filling station.

6.9.5.3 However, the underground tunnel is close to the existing underground hydrant pipeline at the north-west side of T1. According to the hydrant system designer, the underground hydrant pipeline is surrounded by 5 MPa concrete to a minimum depth of 1.2 m and this concrete wall provides protection to the pipeline against external interference. In addition, the existing airside filling station 1 (shown in Figure 6‑8) will be closed with the storage tank emptied because of the construction of the wrap around taxiway. However, the underground hydrant pipeline at the T1 will remain in operation.

6.9.5.4 Due to the close proximity of the underground pipeline at the T1 and construction work of both the underground tunnel and construction of wrap around taxiway, the integrity of the pipeline may be affected due to third party interference and the likelihood is discussed in Section 6.11.1.14 and 6.11.1.15.

6.9.5.5 In order to construct the submarine pipeline, horizontal directional drilling will take place from the west end of the North Runway, as shown in Figure 6‑10 and Figure 6‑11, to the Sha Chau Island. Although the launch site at the HKIA is away from the existing underground pipeline at north airside perimeter road, its integrity may be affected by the construction work. Similarly, as shown in Figure 6-12, the exit location for the HDD at the Sha Chau Island is away from the existing jet fuel receiving facilities and a section of pipeline is required along the bridge to connect the submarine pipeline to the existing jet fuel receiving facilities. In addition, the construction of the extension to Southern Perimeter Road is near the underground pipeline which may be impact by the construction activity. The integrity of the pipeline at both HKIA and Sha Chau Island may be affected due to third party interference and the likelihood is discussed in Section 6.11.1.16.

6.9.5.6 In the aviation fuel tank farm, six hydrant pumps will be installed as shown in Figure 6‑9. According to the hydrant system design expert, the new hydrant pump will be in the same size as existing ones as shown in Photo 6-13. As a result, only the crane installed in the delivery truck is required for lifting and the truck will be located more than 20 m away from the existing jet fuel storage tank, impact to the existing jet fuel storage tank is not expected due to new hydrant pump installation. However, it cannot be ruled out that some of the existing pipeworks may be broken due to falling objects from height (e.g. lifting) and the likelihood is discussed from Section 6.11.1.6 to 6.11.1.12.

Figure 6‑9: Construction Activities in Aviation Fuel Tank Farm

Figure 6‑10: Location of the HDD Launching Site at West End of North Runway

Figure 6‑11: Existing Condition of the HDD Launching Site at West End of North Runway

Figure 6‑12: Existing and Indicative Future Condition at the Sha Chau Island

6.9.6 HAZID Workshop

6.9.6.1 ‘Structured What If Technique’ (SWIFT) is widely applied to systematically identify the potential hazardous scenarios associated with an engineering system. Prior to the HAZID workshop, a preliminary hazard worksheet was prepared based on a review of the historical incident records and other relevant hazard to human life study reports to enable the identification of a preliminary hazard list.

6.9.6.2 The HAZID workshop was conducted on 25 January 2013 in the Airport World Trade Center involving AAHK’s EIA team, AAHK’s Project team, representatives from the scheme design consultants, and the operation team from Aviation Logistics, Airfield, and hydrant fuelling operators AFSC and WFS. The workshop was structured into a number of brainstorming sessions covering each stage of the process, and ‘What if’ questions were posed taking full consideration of the operational modes, sub-system functionality and dependencies, and human interactions, to determine if deviations could result in a foreseeable hazardous state. A list of guidewords had been prepared to help prompt discussions where necessary. The preliminary hazard list had been used as a starting point during the HAZID workshop, and specific issues raised by the team members were recorded as new entries.

6.9.6.3 A SWIFT Log Sheet as attached in Appendix 6.1 had been developed to record the identified hazardous scenarios and the proposed mitigations during the workshop.

6.9.6.4 The scope of the hazard assessment was broken down into specific activities / system at each phase of the project. The breakdown of the project phases and operating sub-system are shown below:

· Construction Phase

· Diversion of submarine jet fuel pipeline

· Connection of the new submarine jet fuel pipeline to the existing underground pipeline in HKIA

· Connection of the new submarine jet fuel pipeline to the off-airport fuel receiving facilities at Sha Chau

· Installation of new hydrant pumps inside aviation fuel tank farm

· Extension of the existing jet fuel hydrant system

· Operation Phase

· Operation of the new jet fuel submarine pipeline

· Operation of the new hydrant pumps inside aviation fuel tank farm

· Operation of the extended part of the jet fuel hydrant system, including the aircraft refueling operation at the new aircraft stands in the airport expansion area

· Operation of the airside vehicle filling station (gasoline / diesel)

6.9.6.5 The hazardous scenario(s) identified are further assessed using a quantitative approach to facilitate the computation of an event or accident frequency as shown in the following sections. Table 6‑5 below provides a summary of the hazardous scenarios identified in the SWIFT Log Sheets.

Table 6‑5: Summary of Hazardous Scenarios for Construction and Operation Phases

Item	Hazardous Scenario	Potential Cause
Construction Phase
Existing submarine pipeline	Jet fuel leakage due to submarine pipeline rupture (Rupture frequency: 3.04E-6 /km/yr; refer to section 6.11.1.1 to section 6.11.1.5)	· The hazardous scenario can be due to anchor drop / drag, vessel sinking, accidental dropping of object / container, land formation activities impact / disturb existing pipeline, Impact force by dynamic compaction of reclaimed land.
Existing underground pipeline at west end of North Runway	Jet fuel leakage from underground pipeline due to HDD construction (Hole size release frequency: 1.65E-5 /km/yr, Rupture frequency: 4.35E-7; refer to section 6.11.1.16)	· The hazardous scenario can be due to construction activities associated with HDD for new pipeline cause damage to existing pipelines (impact, vibration, dropped object, etc.), error in connecting new submarine pipelines to existing pipelines at HKIA (flammable vapours, hot work, poor connection, close proximity of two pipelines), car/vehicle crash impacting the existing pipelines during connection operations
Aviation Fuel Receiving Facility at Sha Chau	Jet fuel leakage from underground pipeline due to HDD construction (Hole size release frequency: 1.65E-5 /km/yr, Rupture frequency: 4.35E-7; refer to section 6.11.1.16)	· The hazardous scenario can be due to construction activities for new pipelines damage existing fuel pipelines, error in connecting new pipelines to existing pipelines (flammable vapours, hot work, poor connection, close proximity of two pipelines), Impact on jetty by barge (e.g. during pipeline pulling), Lightning
Hydrant Pump at Fuel Tank Farm	Jet fuel leakage from pipeworks for hydrant pump inside aviation fuel tank farm (Rupture frequency: 2.5E-5 /km/yr; refer to section. 6.11.1.6 to section. 6.11.1.12)	· The hazardous scenario can be due to installation of hydrant pumps (and associated filters etc) damages existing fuel supply system (or storage tanks) (e.g. dropped object), error in connecting new hydrant pump to existing system (poor connection, incorrect isolation, error in control systems, etc.), fire hazard due to pipeline welding activity
Extension of Fuel Hydrant System	Jet fuel leakage from underground pipeline due to underground tunnel construction and North Runway resurfacing (Hole size release frequency: 1.65E-5 /km/yr, Rupture frequency: 4.35E-7; refer to section. 6.11.1.13 and 6.11.1.15)	· The hazardous scenario can be due to construction activities for new hydrant system damage existing fuel pipelines or hydrant system (3rd party interference (e.g. digging), vehicle impact, etc.), error in connecting new hydrant system/pipelines to Aviation Fuel Tank Farm or to existing hydrant system, ground movement during tunnel construction work
Operation Phase – Jet Fuel Supply System
New submarine pipeline	Jet fuel leakage from pipeline (Rupture frequency: 1.9E-6 /km/yr; refer to section 6.12.1.1)	· The hazardous scenario can be due to corrosion (example due to water accumulated at low point or exposed section at the jetty), material defect, construction defect, earthquake, vessel impact at jetty, pipelines on the bridge at the jetty not properly supported or protected, jet fuel leakage into the annular space between the bore and the new pipeline
New underground pipeline	Jet fuel leakage from pipeline (Hole size release frequency: 3.92E-5 /km/yr, Rupture frequency: 1.03E-6 /km/yr; refer to section 6.12.1.3)	· The hazardous scenario can be due to third party interference, corrosion, material defect, construction defect, subsidence, earthquake, dynamic loading due to aircraft landing on runway, different settlement rate between existing and new reclaimed land (connecting existing pipeline to the new pipeline), abnormal pressure surge (e.g. if all hydrants stop at the same time), stray current due to airport express rail, aircraft crash, increased pressure hazards (if increased pressure required in system to provide 9-10 bar at furthest point of Third Runway hydrant system)
New hydrant system and fuelling operation	Jet fuel spillage from hydrant (Spillage frequency: 0.230 /yr; refer to section. 6.12.1.4 to 6.12.1.11)	· The hazardous scenario can be due to rupture of hydrant riser pipework , o-ring or gasket fail at pit valve, poppet seal fail (once pilot valve is opened), hydrant coupler failure at connections, hydrant Coupler failure at hose, hydrant coupler failure due to vehicle impact, spill from dispensing vehicle, hydrant dispenser moves off inadvertently by driver whilst the hose still connected or vehicle rolls, hydrant dispenser moves off whilst the hose still connected or vehicle rolls due to high wind, aircraft vent failure, engine fire at hydrant dispenser, hydrant/dispenser struck by lightning, thermal stress on pipeline due to 'closed in' jet fuel, vehicle impact to hydrant pit, accidents involving fuel bowser for defueling
Hydrant Pump	Jet fuel leakage from pipeworks at Fuel Tank Farm (Failure frequency: 0.0629 /yr; refer to section 6.12.1.2)	· The hazardous scenario can be due to mechanical seal failure, failure to manually breathe out air from filter, with air accumulated and compressed, undersize of motor causing pump overheating, minor leak in fuel farm which escalates
Operation Phase – Airside Vehicle Filling Station
Gasoline / Diesel road tanker	· Gasoline / Diesel release and subsequent ignition · (Catastrophic failure of road tanker: 1E-5 per tanker /yr, Partial failure of road tank: 5E-7 per tanker /yr, Guillotine failure of flexible delivery hose: 2E-7, Partial failure of flexible delivery hose: 4E-7; refer to section 6.13.1)	· The hazardous scenario can be due to tanker failure due to corrosion, tanker failure due to construction defect, tanker failure due to material defect · The hazardous scenario can be due to tanker failure due to external impact (struck by other vehicle), hose misconnection due to human error, hose rupture due to tanker drive away inadvertently, hose rupture due to tanker being moved away by high wind, hose failure (e.g. rupture), failure of coupler at delivery hose, loading pipework over-pressurisation due to mis-operation, road tanker overturn due to high wind, road tanker at filling station struck by lightning, engine fire at road tanker, tanker struck by aircraft, vehicle crash into fuel dispenser
Underground Pipework	· Gasoline / Diesel release and subsequent ignition · (The scenario does not cause offsite risk, it is therefore excluded from the current study; refer to section 6.13.1.1)	· The hazardous scenario can be due to pipework failure due to corrosion, pipework failure due to construction defect, pipework failure due to material defect, pipework failure due to third party interference
Underground Storage Tank	· Gasoline / Diesel release and subsequent ignition · (The scenario does not cause offsite risk, it is therefore excluded from the current study; refer to section 6.13.1)	· The hazardous scenario can be due to tank failure due to corrosion (e.g. due to stray current), tank failure due to construction defect, tank failure due to material defect, tank failure due to earthquake, tank failure due to subsidence, tank failure due to third party interference, overfilling of storage tank by road tanker, failure of safety relief valve

6.10 Data Collection and Analysis

6.10.1 Meteorological Data

6.10.1.1 The weather conditions applied for this study have been summarised in Table 6‑6. Those data, which was obtained from wind rose data from HKIA weather station in combination with the weather class data from Sha Chau weather station, represent the probabilities for the combination of wind speed, direction and pasquill stability class used in the assessment.

Table 6‑6: Weather Probabilities (Day and Night)

	Day				Night
Wind Speed (m/s)	2.5	3	7	2	2.5	3	7	2
Atmospheric Stability	B	D	D	F	B	D	D	F
Wind Direction	Fraction of Occurrence
0°	0.027	0.0046	0.037	0.003	0	0.0046	0.052	0.011
30°	0.0235	0.004	0.038	0.0026	0	0.004	0.053	0.0095
60°	0.063	0.0108	0.069	0.007	0	0.0108	0.096	0.026
90°	0.036	0.0062	0.17	0.004	0	0.0062	0.238	0.015
120°	0.018	0.003	0.100	0.002	0	0.003	0.141	0.007
150°	0.036	0.006	0.032	0.004	0	0.006	0.044	0.015
180°	0.018	0.0031	0.0106	0.002	0	0.003	0.0148	0.007
210°	0.014	0.0025	0.04	0.0016	0	0.002	0.056	0.0058
240°	0.018	0.003	0.03	0.002	0	0.003	0.04	0.007
270°	0.027	0.005	0.0127	0.003	0	0.005	0.018	0.011
300°	0.029	0.0049	0.006	0.003	0	0.0049	0.0089	0.012
330°	0.018	0.0031	0.032	0.002	0	0.003	0.044	0.007

6.10.2 Population and Traffic Data

6.10.2.1 It is important to obtain the population density near the hazardous installation in order to estimate the number of people being affected by an incident of hazardous event such as pool fire. The method to be adopted for obtaining the population will be discussed in the following paragraphs.

Submarine Pipeline

6.10.2.2 The underground submarine pipeline is connected between Sha Chau and HKIA and it falls into the South China Sea. The marine population in the South China Sea depends on the number of vessels travelling in the region and the number of person inside each vessel. The marine population density is 0.15 /ha ^[6].

Aviation Fuel Tank Farm

6.10.2.3 Four types of population will be considered:

· Pedestrian population on footpaths and pavement;

· Road population;

· Building population; and

· Construction worker

Pedestrian Population on Footpath and Pavement

6.10.2.4 Pedestrians on the pavement, for example at Scenic Road, are considered as outdoor population and a site survey has been conducted to estimate the pedestrian density.

6.10.2.5 The population density can be calculated using the following equation:

Pavement Population (persons/km²) = P / 1000 / Q / W

Where,

P is number of pedestrian passing a given point per hour

W is the road width (m)

Q is the pedestrian speed (km/h), assumed 7.2 km/h^[10]

Road Population

6.10.2.6 Free flow traffic population is estimated by adopting population density approach. The traffic density information used in this study is based on the site survey. The following equation is used to calculate the free flow traffic population:

Population of route section (persons/m²) = F * O / ( L * V )

Where:

F is Hourly Traffic Flow based on site survey data (number of vehicles per hour)

O is the average vehicle occupancy (number of person per vehicle)

L is width of road (km)

V is average vehicle speed (km/h)

6.10.2.7 The vehicle occupancy is estimated based on the average vehicle occupancy of transport route reported in the Annual Traffic Census (ATC, 2011). Data from a relevant core counting station are selected.

6.10.2.8 The average vehicle speed is assumed to be 60 km/h for highway and 50 km/h for non-highway road section ^[15].

Building Population and Construction Worker

6.10.2.9 The population density for both building population and construction worker are assessed by site survey and by consulting with relevant parities.

Jet Fuel Underground Pipeline and Hydrant Pit Valve

6.10.2.10 The fuel hydrant system and the underground pipelines are located in the restricted area of the airport and to which access is strictly controlled. Therefore, the population to be affected by a fuel leakage incident will include the following groups:

· Ground crew;

· Cabin/flight crew;

· Passengers; and

· Construction worker.

6.10.2.11 Photo 6‑11 and Photo 6‑12 show the positioning of support vehicles around an aircraft during jet fuel refuelling. It can be seen from Photo 6‑12 that a ground crew was trying to upload boxes of packaged materials into the aircraft when jet fuel refuelling was in process. The support vehicles include toilet service truck, baggage tug & trailer, ground power unit, containerised cargo loader, catering truck, etc. Based on Figure 6‑26, a total of 8 - 10 support vehicles were deployed at one side of the large aircraft.

6.10.2.12 The average number of passengers per flight at peak hour in 2030 is estimated based on estimated average load (i.e. occupancy) per flight at peak hour in 2030 which is 85 % of the aircraft capacity^[28] and an assumption that 90 % of passengers will be present at the time of the refuelling operation. The crew member (i.e. flight attendant and pilot) in each flight is assumed to be 10 for large aircraft and six for small aircraft. According to AAHK, in each aircraft turnaround, there are 15 staff working on the ground surface to provide various services for both large and small aircraft and it is assumed there are 10 staff working inside the aircraft to provide catering and cleaning service in each turnaround.In case of jet fuel leakage from hydrant pit valve / delivery hose during aircraft refuelling, aerosol droplet will be formed to cause potential flash fire. After a few seconds, the droplets will either be diluted by air or condense back to form a liquid pool if they are not ignited immediately. A summary of the population data is shown in Table 6‑7.

6.10.2.13 The population groups will be considered separately as the risks to each group may be different. For the purpose of the risk assessment, the likelihood that these various population groups are present at the time of a potential event is shown in Table 6‑8^[2] and Table 6‑9.

Table 6‑7: Population Present at each Aircraft Parking Stand and Aviation Fuel Tank Farm

Population Group	Population
Turnaround crew on ground surface (large and small aircraft)	15
Turnaround crew inside the aircraft (large and small aircraft)	10
Cabin / flight crew (large aircraft)	10
Cabin / flight crew (small aircraft)	6
Passenger (large aircraft)	240
Passenger (small aircraft)	138
Construction workers inside aviation fuel tank farm	10
Construction workers immediately near existing facilities outside aviation fuel tank farm	20

Table 6‑8: Probability that people are potentially present (Refuelling without passengers on board)

Population Group	Probability of Being Present
Turnaround crew (both on ground and inside aircraft)	0.4
Cabin / flight crew	0.4
Passengers	0

Table 6‑9: Probability that people are potentially present (Refuelling with passengers on board)

Population Group	Probability of Being Present
Turnaround crew (both on ground and inside aircraft)	1
Cabin / flight crew	1
Passenger	1

Photo 6‑11: Dispenser Vehicle Positioning around an Aircraft during Jet Fuel Refuelling

Photo 6‑12: Support Vehicles Positioning around an Aircraft during Jet Fuel Refuelling

Airside Vehicle Filling Station

6.10.2.14 Based on the initial scheme design for the new airport facilities and within the 150 m radius of the proposed new airside filling station, there are eight other proposed buildings which include Airside Fire Station, Logistics Support Facility, Airside Office Building, Ground Service Equipment (GSE) Storage Area, GSE Maintenance Facility, Early Baggage Storage Facility, Refuse Compactor & Recycling, Security Gatehouse and Flight Catering Facility (Satellite) ^[41]. The actual designs and final locations and layouts of these buildings are not yet confirmed, therefore, the following assumptions have been made.

6.10.2.15 There will have an additional airside fire station to provide additional capability to enhance the available fire fighting capability. There are existing two airside fire stations which have 245 staff ^[42], with each station having, on average, 123 staff. With three shifts per day, there are 41 staff in each fire station at any one time. Since the fire station will be operating in 24 hours, firemen will be present in both day and night time. Taking into account of some staff will be on leave and have meetings outside the fire station, a high presence probability of 90 % is assumed.

6.10.2.16 A site for a logistics support facility has been safeguarded in the eastern support area. It is anticipated that the facility will be operating 24 hours with 150 staff being present in both day and night time with reference to existing operation with similar nature such as the Air Mail Centre. Taking into account of some staff will be on leave, a high presence probability of 90 % is assumed.

6.10.2.17 Airside office building is designated for daily administration. It is expected building height restriction will be imposed for building near the runway, therefore, a four floors building is assumed. Each floor is assumed to have 10 units with two persons inside each unit ^[15]. Therefore, there are 80 persons inside the building. According to AAHK, an Integrated Airport Control Centre (IAC) may be potentially housed in the same building with 30 staff operating in 24 hours. Taking into account of some staff will be on leave, a high presence probability of 90% is assumed.

6.10.2.18 GSE Maintenance Facility is designated for daily maintenance of the GSE vehicle / equipment and it will be one storey ^[41]. Each floor is assumed to have six units with six persons in each unit ^[15]. Therefore, there are 36 persons inside the building. Since the facility will be operating in 24 hours, staff will be present in both day and night time. Taking into account of some staff will be on leave and have meetings outside the facility, a high presence probability of 90 % is assumed.

6.10.2.19 GSE storage area is designated for equipment storage and it occupies a relatively large amount of space. Since the area is to accommodate the anticipated GSE vehicle fleet when not in use, it is not anticipated that there will be a lot of persons staying in the area. It is assumed there are 20 persons in the area. Staff will be present in the storage area only when there is GSE vehicle fleet not in use. The presence probability of 50 % is assumed.

6.10.2.20 An early baggage storage facility is provided above the baggage handling system tunnel. It is expected the facility will be highly automatic with minimal manual operation. It is assumed there will have 10 staff. It is assumed the facility will be operating in 24 hours, staff will be present in both day and night time. Taking into account of some staff will be on leave, a high presence probability of 90 % is assumed.

6.10.2.21 Refuse compactor & recycling facility is provided to handle aircraft waste, with waste streams originating from the third runway concourse and support areas being separated at source. It is assumed there will have 20 staff. It is assumed the facility will be operating in 24 hours, staff will be present in both day and night time. Taking into account of some staff will be on leave, a high presence probability of 90 % is assumed

6.10.2.22 A security gatehouse is provided to facilitate access from the landside to the airside. It is assumed there will have five security guards. Since the gatehouse will be operating in 24 hours, staff will be present in both day and night time. In order to ensure the security inside the airport, the presence probability of 100 % is assumed.

6.10.2.23 Flight catering facility (satellite) will be provided to support the catering operation at the eastern support area to cater for last minute top up, while the main production process would remain at the existing facility. The facility will be one storey ^[41] and it is assumed to have six units with six persons in each unit ^[15]. Therefore, there are 36 persons inside the building. It is assumed the facility will be operating in 24 hours, staff will be present in both day and night time. Taking into account of some staff will be on leave and outside the facility to deliver the food package to the aircraft, a high presence probability of 90 % is assumed.

6.10.2.24 There are roads around the airside petrol filling station (PFS) and transient population (i.e. vehicle) should be taken into account. Since the 3RS has not yet been in operation, traffic survey cannot be conducted. It is, therefore, assumed that there will be one vehicle running in every 10 m and each vehicle carries two persons. A summary of the population data near the airside filling station is provided in Table 6‑10 and Table 6‑11. The tentative layout of the eastern support area is shown in Figure-6-13.

Table 6‑10: Population Data within 150 m Radius of the Airside Petrol Filling Station

Item No. (Refer to Figure 6‑13)	Population Group	Population
1	Airside Fire Station	41
2	Logistics Support Facility	150
3	Airside Office Building (potentially included IAC)	110
4	GSE Maintenance Facility	36
5	GSE Storage Area	20
6	Early Baggage Storage Facility	10
7	Refuse Compactor & Recycling Facility	20
8	Security Gatehouse	5
9	Flight Catering Facility (Satellite)	36

Table 6‑11: Presence Probability and Indoor / Outdoor Ratio for Population near Petrol Filling Station

Building	Indoor Ratio	Outdoor Ratio	Presence Probability
Building	Indoor Ratio	Outdoor Ratio	Day	Night
Airside Fire Station	0.9	0.1	0.9	0.9
Logistics Support Facility	0.95	0.05	0.9	0.9
Airside Office Building (potentially included IAC)	0.9	0.1	0.9	0.9
GSE Maintenance Facility	0.9	0.1	0.9	0.9
GSE Storage Area	0	1	0.5	0.5
Early Baggage Storage Facility	0.9	0.1	0.9	0.9
Refuse Compactor & Recycling Facility	0.9	0.1	0.9	0.9
Security Gatehouse	0.5	0.5	1	1
Flight Catering Facility (Satellite)	0.9	0.1	0.9	0.9

Figure 6‑13: Indicative Layout of Eastern Support Area

6.10.3 Ignition Probability

Jet Fuel Spillage on Sea Surface

6.10.3.1 To be consistent with the previously approved risk assessment, the ignition probability of 0.008 is assumed for a pool of aviation fuel on the sea surface following pipeline rupture ^[6].

Jet Fuel Spillage on Land Surface

6.10.3.2 The probability of ignition is estimated based on the OGP Risk Assessment Data Directory ^[17] using the release type for tanks and low pressure transfer lines for combustible liquids stored at ambient pressure and at temperatures below the flash point (e.g. oil, diesel and fuel oil). The total ignition probability is as shown in Table 6‑12.

Table 6‑12: Total Ignition Probability for Jet Fuel Spillage on Land

Release Rate (kg/s)	Probability of Ignition
0.1 - 1	0.0010
2 - 5	0.0011
10	0.0014
20	0.0021
50 - 1000	0.0024

6.10.3.3 The data assumes that the immediate ignition probability is 0.001 and is independent of the release rate. The delayed ignition probability can be obtained by subtracting 0.001 from the total ignition probability from the corresponding release rate as shown in Table 6‑12.

Petrol Leakage Airside Filling Station

6.10.3.4 Petrol is a liquid mixture of hydrocarbon molecule and it is more volatile than jet fuel and diesel oil, therefore the ignition probability of the petrol should be higher than those specified in the OGP Risk Assessment Data Directory. The ignition probabilities from Cox, Lees and Ang model, summarised in Table 6‑13, are used for the petrol release scenarios. The values given by the model present the total ignition probabilities including both immediate and delayed ignition. It is assumed in the current study that the chances for the immediate and delayed ignition are the same.

Table 6‑13: Ignition Probability for Petrol ^[31]

Size of Leakage	Ignition Probability
Size of Leakage	Gas Release	Liquid Release
Minor (<1 kg/s)	0.01	0.01
Major (1-50 kg/s)	0.07	0.03
Massive (>50 kg/s)	0.30	0.08

6.11 Construction Phase (Aviation Fuel)

6.11.1 Frequency Assessment

Submarine Pipeline

6.11.1.1 The third runway will be constructed by land formation. Based on the latest schedule, the land formation work will proceed in parallel with the submarine pipeline diversion. However, an exclusion zone of 100 m on either side of the existing submarine pipeline will be set up where land formation activity is prohibited. In addition, compaction of the reclaimed land will not involve major impacts/pounding or dynamic loads, so the existing submarine pipeline is unlikely to be disturbed by the impact force generated from the dynamic compaction of the reclaimed land. To further protect the submarine pipeline, ground improvement will take place only after the pipelines have been diverted.

6.11.1.2 When the diverted submarine pipelines are in place, they have to be connected to the existing facilities at both the Sha Chau jetty and HKIA. At Sha Chau, the connection can be simply carried out by un-bolting the flange at the existing pipelines and connecting to the diverted pipeline using the same flange, after drain out of jet fuel inside the pipelines.

6.11.1.3 However, at the HKIA side, flanges are not available for the connection and pipeline cutting is required. A new isolation valve chamber will be constructed to allow section isolation. To avoid possible jet fuel leakage, one of the two pipelines will be isolated and the pipeline will be pigged empty by use of water pumped through the pipeline until the water discharging from the other end of the pipeline has hydrocarbon content less than discharge limits. When confirmed as being clean the remaining water will be displaced by a pig propelled by compressed air. A pre-fabricated “spool’ comprising a 5D induction bend to align the new pipeline to make the connection to the existing upstream pipeline will be provided.

6.11.1.4 To further enhance proper isolation of the correct submarine pipeline, a pre-trial will be conducted to ensure the correct pumps and valves will operate properly as required with this verified by on site visual inspection. The submarine pipeline changeover and all related construction work will be monitored by the AAHK Project Engineers, Work Supervisors, Construction Manager and the existing Tank Farm Operator. Considering that there are only four submarine pipeline connections to be made for the diversion and all the connection works will be closely monitored by various parties, it is believed the risk level will be acceptable.

6.11.1.5 Marine traffic flow will increase during the proposed land formation work, and the existing submarine pipeline will be subject to a higher risk from damage due to anchor drop or drag, vessel sinking, etc. In the PAFF study, the likelihood of occurrence of submarine pipeline rupture was estimated to be 1.9E-6 /km/yr ^[6]. According to initial marine traffic impact assessments conducted by the scheme design, there will be in average 64 construction vessel transits /day to carry out the land formation work while in a normal day without the construction work, there are 106 daytime¹ vessel movements /day in the region where the submarine pipeline is currently buried ^[40], therefore, the likelihood of occurrence of submarine pipeline rupture will approximately be increased by 60 %. As a result, the submarine pipeline rupture failure frequency is estimated to be 3.04E-6 /km/yr. There are two submarine pipelines and the length of each submarine pipeline is 6 km.

1 This refers to vessel movements between 7am – 7pm. No information on night time vessel movements is available.

Hydrant Pumps Installation inside Aviation Fuel Tank Farm

6.11.1.6 The existing hydrant pumps inside the aviation fuel tank farm are shown in Photo 6‑13. From the photo, it can be seen that the sizes of the pumps are small and heavy machine is not required for lifting during installation. According to the hydrant system design expert, the new hydrant pumps will be in the same size as existing ones. As a result, only the crane installed in the delivery truck is required for lifting and the truck will be located more than 20 m away from the existing jet fuel storage tank, impact to the existing jet fuel storage tank is not expected due to new hydrant pumps installation. The hydrant pumps are connected to the main jet fuel pipeline, which supplies jet fuel to the hydrant pit valve in the apron, through parallel pipeworks as shown in Photo 6‑14.

6.11.1.7 The area reserved for the new hydrant pumps is shown in Photo 6‑16. During the installation, a vehicle carrying the pumps will be parked on the right hand side above the reserved area and it will deliver the hydrant pumps using truck mounted crane. Outrigger will be deployed to stabilise the vehicle during the lifting.

6.11.1.8 Detailed method statement and risk assessment for the process of tie-in of the new pipework to the main jet fuel pipeline has yet been developed. However, according to the hydrant system design expert, before the construction work starts, the main jet fuel pipeline will be isolated and jet fuel inside the pipeline will be de-fuelled and purged to ensure flammable jet fuel vapour residual will not be remaining inside the pipeline. After that, pump will be stopped and isolation valve will be activated to isolate the pipeline section before connecting to the new hydrant pump. Hot work is not required to be conducted on the purged main jet fuel pipeline, instead, a section of the existing pipeline will be taken out by un-bolting the flange as shown in Photo 6‑17 and a new pipeline with tee-joints will be connected. The tee-joint will be used to connect to the new hydrant pump pipework under the existing western apron development.

6.11.1.9 To further enhance a proper isolation of the correct main jet fuel pipeline, a pre-trial will be conducted to ensure the correct pumps and valves will operate properly as required and this can be verified by on site visual inspection. Detailed method statement will be prepared and reviewed by AAHK Project Engineers, Work Supervisors, Construction Manager and the existing Tank Farm Operator and the Fire Services Department of HKSAR. Also, the whole construction work will be monitored by the representatives from the existing tank farm operator and the hydrant system changeover shall be conducted by the existing aviation tank farm operator. Once the new hydrant pump network is constructed, a pressure test will be conducted to ensure the integrity of the hydrant system.

6.11.1.10 As the main jet fuel pipeline will be emptied by purging thoroughly to remove all flammable gas residual before the tie-in process and the chance of having jet fuel leakage from the main jet fuel pipeline with a subsequent ignition is not envisaged, especially inside the boundary of the aviation fuel tank farm where naked flame is prohibited. Therefore, the construction work should not impose any significant impact to the existing facilities. According to the UKOPA database, the pipeline rupture failure rate due to external interference is 4.35E-7 /km/yr which is insignificant as compared with the pipework rupture failure rate as discussed below.

6.11.1.11 However, it cannot be ruled out that some of the pipeworks may be broken due to falling objects from height (e.g. lifting). Pipework rupture due to third party influence is 2.5E-5 /km/yr ^[46].

6.11.1.12 It is unlikely that there will be much heavy machinery operating inside the small new hydrant pumps reserved area, therefore the jet fuel ignition probability of 0.0024 recommended by the OGP ^[17] will be adopted. Assuming the total length of the pipework within the hydrant pump bay is 2 km, the likelihood of occurrence of a fire due to the construction work is 1.2E-7 /yr.

Photo 6‑13: Existing Hydrant Pump inside Aviation Fuel Tank Farm

Photo 6‑14: Connection of existing Hydrant Pump to main jet fuel pipeline

Photo 6‑15: Basin provided to Existing Hydrant Pumps

Photo 6‑16: Area Reserved for Future Hydrant Pumps inside Aviation Fuel Tank Farm

Photo 6‑17: Flanged reserved for New Hydrant Pump Connection

Connection of Underground Pipeline to Mid-field Apron

6.11.1.13 Similar to the connection of the new hydrant pump inside the aviation tank farm, the connection of the new underground pipeline to the mid-field apron will be proceeded only after the existing pipeline has been isolated, defueled and purged to remove any flammable gas residual. A pre-trial will be conducted to ensure the correct pumps and valves will operate properly as required by verifying it on site through visual inspection. This will ensure the pipeline has been properly isolated. Also, the hydrant system isolation process shall be conducted by the tank farm operator.

Underground Tunnel Construction in T1 and Midfield and North Runway Taxiway Modification Work

6.11.1.14 Both the construction of an underground tunnel and the North Runway and taxiway modification works may affect the integrity of the nearby underground pipeline at T1. During the tunnel construction work period, the North Runway will be closed. Although the risk to the nearby underground pipeline at T1 cannot be ruled out, stringent construction method will be imposed to minimise the risk.

6.11.1.15 AAHK has implemented an effective Safety Management System for all construction works being undertaken in the airside to prevent any potential interruption to the aircraft operation and existing ground facilities. The frequency of underground pipeline damaged by construction activities has made reference to the UKOPA database, where the likelihood of hole size (50 mm) pipeline failure due to external influence is 1.65E-5 per km-yr. The pipeline rupture failure due to external influence is 4.35E-7 per km-yr. The length of pipeline section in T1 and Midfield to be affected by the construction activities are about 1.8 km and 1.5 km respectively. The data presented in the UKOPA report covers reported incidents where there was an unintentional loss of product from a pipeline within the public domain, and not within a compound or other operational area.

Horizontal Directional Drilling for Submarine Pipeline Diversion from HKIA to Sha Chau and Construction of the South Perimeter Road Extension

6.11.1.16 HDD will be undertaken from the west end of the existing North Runway to Sha Chau Island. The launch site at HKIA is away from the existing underground pipeline at North Perimeter Road, but its integrity may be affected by the construction work. However, the exit location for the HDD at the Sha Chau Island is far away from the existing jet fuel receiving facilities and a section of pipeline is required along the bridge to connect the submarine pipeline to the existing jet fuel receiving facilities. In addition, the construction of the extension to South Perimeter Road at the HKIA is about 13 m away from the underground pipeline which may be impact by the construction activity. The integrity of the pipeline at the HKIA may be affected due to third party interference of the propose construction activities. According to the UKOPA database, the likelihood of hole size (50 mm) pipeline failure due to external influence is 1.65E-5 per km-yr. The pipeline rupture failure due to external influence is 4.35E-7 per km-yr. There are two underground pipelines at the North Perimeter Road in HKIA. Since only a portion of the pipelines immediately near the construction work will be affected, the length of the pipeline section to be affected is 500 m.

Table 6‑14: Summary of Frequency/Probability of the Identified Scenarios for Construction Phase

Scenario	Frequency (per km year)
Jet fuel leakage due to submarine pipeline rupture	3.04E-6
Jet fuel leakage from pipework for hydrant pump inside aviation fuel tank farm	2.50E-5
50mm hole size release of jet fuel leakage from underground pipeline due to underground tunnel construction and North Runway wrap around taxiway modification	1.65E-5
Jet fuel leakage from underground pipeline rupture due to underground tunnel construction and North Runway wrap around taxiway modification	4.35E-7
50mm hole size release of jet fuel leakage from underground pipeline due to HDD construction	1.65E-5
Jet fuel leakage from underground pipeline rupture due to HDD construction	4.35E-7

6.11.2 Event Tree Analysis

Submarine Pipeline

6.11.2.1 When one of the two submarine pipelines is broken, the automatic isolation system will be activated to stop the supply of jet fuel through the pipeline in 3 minutes ^[6] in order to minimise the loss. However, in case of the failure of the isolation system, a continuous release of 60 minutes is assumed ^[6]. The probability of failure of the automatic isolation system is 0.1 ^[6]. The event tree for the jet fuel leakage from submarine pipeline is shown in Figure 6‑14. The ignition probability is 0.008 ^[6].

Figure 6‑14: Event Tree for Jet Fuel Leakage due to Submarine Pipeline Rupture

Table 6‑15: Probability Data for Event Tree Analysis – Submarine Pipeline (refer to Figure 6‑14)

Item	Value	Justification/Reference
Successful automatic isolation	0.9	Ref.: 6

Pipeline at West End of North Runway

6.11.2.2 When the pipeline is damaged by the HDD construction, the onsite construction worker will notify the operator to shut down the isolation valve to prevent a prolonged jet fuel leakage. The isolation of the pipeline can be achieved in 5 minutes. It is assumed that in the worst case it will take 10 minutes to isolate a jet fuel leakage incident. Immediate ignition may lead to flash fire followed by pool fire while delayed ignition may result in pool fire. The event tree for jet fuel leakage from underground pipeline is shown in Figure 6‑15 below.

Figure 6‑15: Event Tree for Jet Fuel Leakage from Underground Pipeline due to HDD Construction at HKIA and Sha Chau

Table 6‑16: Probability Data for Event Tree Analysis – Pipeline at HKIA and Sha Chau (refer to Figure 6‑15)

Item	Value	Justification/Reference
Successful isolation by ESB in 5 minutes	0.987	Suggested by the AFSC
Immediate Ignition	0.001	OGP database ^[17]
Delayed Ignition	0.0014	OGP database ^[17]

Underground Pipeline at the Terminal 1

6.11.2.3 When the underground pipeline is damaged, jet fuel will be spilled and such a spillage will continue until someone depresses the emergency stop button. As the apron will be filled with airport staff during normal operating hours, it is assumed that the leakage can be spotted by staff within 3 minutes. The maximum separation distance of ESBs is 75 m, with a running speed of 2.5 m/s ^[30], it shall take approximately 30 seconds to reach the closest ESB and activate the button. The pump and the isolation valve will be shut within 1 minute. Therefore, the overall delay time is estimated to be around 5 minutes. It is assumed that in the worst case it will take 10 minutes to isolate a jet fuel leakage incident. Immediate ignition may lead to flash fire followed by pool fire while delayed ignition may result in pool fire. The event tree for jet fuel leakage from underground pipeline is shown in Figure 6‑16.

Figure 6‑16: Event Tree for Jet Fuel Leakage from Underground Pipeline at the Terminal 1 due to Underground Tunnel Construction and North Runway wrap around taxiway modification

Table 6‑17: Probability Data for Event Tree Analysis – Underground Pipeline at the Terminal 1 (refer to Figure 6‑16)

Item	Value	Justification/Reference
Successful isolation by ESB in 5 minutes	0.987	Suggested by the AFSC
Immediate Ignition	0.001	OGP database ^[17]
Delayed Ignition	0.0014	OGP database ^[17]
Aircraft with passenger in vicinity to the failed underground Pipeline	0.5	According to the Initial Scheme Design Report, the usage rate of the parking stands in 2030 will be 100 % at the peak hour. However, while an aircraft is parked at the parking stand, half of the time will have no onboard passengers but there will be routine shift of flight crew members, offloading luggage, aircraft maintenance such as cabin cleaning. Therefore, a probability of 0.5 (i.e. 1 * 0.5) is assumed for aircraft with passenger in the vicinity to the failed underground pipeline
Is it a large aircraft	0.635	Ref.:28

Table 6‑18: Summary of Frequency Breakdown of Events for each Identified Scenario – Construction Phase

Scenario	Frequency (per year)
Submarine Pipeline (refer to Figure 6‑14)
Pool fire from submarine pipeline with immediate isolation	2.63E-07
Pool fire from submarine pipeline with delayed isolation	2.92E-08
Pipeline at North Airside Perimeter Road (refer to Figure 6‑15)
Flash fire followed by pool fire for hole size release of underground pipeline_5 minutes	1.63E-08
Pool fire for hole size release of underground pipeline_5 minutes	2.28E-08
Jet fuel pool only	1.63E-05
Flash fire followed by pool fire for hole size release of underground pipeline_10 minutes	2.15E-10
Pool fire for hole size release of underground pipeline_10 minutes	3.00E-10
Jet fuel pool only	2.14E-07
Flash fire followed by pool fire for underground pipeline rupture_5 minutes	4.29E-10
Pool fire for underground pipeline rupture_5 minutes	6.00E-10
Jet fuel pool only	4.28E-07
Flash fire followed by pool fire for underground pipeline rupture_10 minutes	5.65E-12
Pool fire for underground pipeline rupture_10 minutes	7.91E-12
Jet fuel pool only	5.64E-09
Hydrant Pump and Pipework inside Aviation Fuel Tank Farm
Pool fire due to jet fuel leakage from hydrant pump installation inside aviation fuel tank farm	1.2E-07
Underground Pipeline at the Terminal 1 and Midfield (refer to Figure 6‑16)
Flash fire followed by pool fire for hole size release of underground pipeline_5 minutes_with passenger onboard a large aircraft	1.71E-08
Flash fire followed by pool fire for hole size release of underground pipeline_5 minutes_with passenger onboard a small aircraft	9.82E-09
Flash fire followed by pool fire for hole size release of underground pipeline_5 minutes_without passenger onboard	2.69E-08
Pool fire for hole size release of underground pipeline_5 minutes_with passenger onboard a large aircraft	2.39E-08
Pool fire for hole size release of underground pipeline_5 minutes_with passenger onboard a small aircraft	1.37E-08
Pool fire for hole size release of underground pipeline_5 minutes_without passenger onboard	3.76E-08
Jet fuel pool only without ignition	5.37E-05
Flash fire followed by pool fire for hole size release of underground pipeline_10 minutes_with passenger onboard a large aircraft	2.25E-10
Flash fire followed by pool fire for hole size release of underground pipeline_10 minutes_with passenger onboard a small aircraft	1.29E-10
Flash fire followed by pool fire for hole size release of underground pipeline_10 minutes_without passenger onboard	3.54E-10
Pool fire for hole size release of underground pipeline_10 minutes_with passenger onboard a large aircraft	3.15E-10
Pool fire for hole size release of underground pipeline_10 minutes_with passenger onboard a small aircraft	1.81E-10
Pool fire for hole size release of underground pipeline_10 minutes_without passenger onboard	4.96E-10
Jet fuel pool only without ignition	7.07E-07
Flash fire followed by pool fire for rupture of underground pipeline_5 minutes_with passenger onboard a large aircraft	4.50E-10
Flash fire followed by pool fire for rupture of underground pipeline_5 minutes_with passenger onboard a small aircraft	2.58E-10
Flash fire followed by pool fire for rupture of underground pipeline_5 minutes_without passenger onboard	7.08E-10
Pool fire for rupture of underground pipeline_5 minutes_with passenger onboard a larget aircraft	6.29E-10
Pool fire for rupture of underground pipeline_5 minutes_with passenger onboard a small aircraft	3.61E-10
Pool fire for rupture of underground pipeline_5 minutes_without passenger onboard	9.90E-10
Jet fuel pool only without ignition	1.41E-06
Flash fire followed by pool fire for rupture of underground pipeline_10 minutes_with passenger onboard a large aircraft	5.92E-12
Flash fire followed by pool fire for rupture of underground pipeline_10 minutes_with passenger onboard a small aircraft	3.40E-12
Flash fire followed by pool fire for rupture of underground pipeline_10 minutes_without passenger onboard	9.33E-12
Pool fire for rupture of underground pipeline_10 minutes_with passenger onboard a large aircraft	8.28E-12
Pool fire for rupture of underground pipeline_10 minutes_with passenger onboard a small aircraft	4.76E-12
Pool fire for rupture of underground pipeline_10 minutes_without passenger onboard	1.30E-11
Jet fuel pool only	1.86E-08

6.11.3 Consequence Analysis

6.11.3.1 Consequence analysis is conducted to determine the size of leakage of jet fuel under each of the identified scenarios during construction phase, and the corresponding safety effects on the construction workers, airport staff and public. The following consequence models have been applied.

Submarine Pipeline

6.11.3.2 The existing twin submarine jet fuel pipelines are buried approximately 6 m below seabed for the section connecting to the airport and 10 m below seabed for the section between the airport and the receiving facilities at the Sha Chau. The pipelines are protected by rock armour and there is an integrated fuel leakage detection system which can shut down the fuel pumps at the Sha Chau automatically in case of jet fuel leakage is detected.

6.11.3.3 If the submarine pipeline is ruptured, the jet fuel will first be released under momentum due to the pressure inside the pipelines. The plume of the released fuel will then rise to the sea surface by buoyancy effect to form a pool layer of jet fuel with an assumed thickness of 10 mm ^[6].

6.11.3.4 The total volume of the fuel released depends on the flow rate of the jet fuel inside the pipelines and the time required for the fuel leakage detection system to shut down the fuel pumps at the Sha Chau. In the Hazard to Life Assessment for the PAFF ^[6], the shut down response time for the fuel pump was assumed to be 3 minutes if the detection system functions properly, however the time will be increased to 60 minutes by manual isolation if the integrated detection system failed. However, during the construction work, representatives from the relevant parties will be present, so it will take a much shorter time to do the manual isolation. It is assumed the time taken will be 30 minutes.

6.11.3.5 Since the flow rate of jet fuel inside the submarine pipeline is 1,500 m³/hr, it will release 75 m³ of jet fuel into the sea if the fuel pump can be stopped in 3 minutes and this is equivalent to a pool radius of 49 m. However the released quantity will be increased to 750 m³ if it takes 30 minutes to isolate the leakage and a jet fuel pool of radius of 155 m will be formed. Besides, fuel is lighter than water, significant portion of the pipeline quantity will be leaked out after pumps are stopped due to depressurization (i.e. internal volume of the pipeline: 1,178 m³).

6.11.3.6 The marine population density is 0.15 per ha ^[6]. Because of the land formation construction activity, the marine traffic is to be increased by 60 %. Therefore, the marine population density during the construction period will be 0.24 per ha.

Hydrant Pump Installation inside Aviation Fuel Tank Farm

6.11.3.7 The pipeworks are connected to the existing 13 hydrant pumps with each pump capacity of 5.5 m³/min. Assuming a falling object can seriously damage the pipeworks connecting to three existing hydrant pumps, this will result in a jet fuel leakage at a flow rate of 16.5 m³/min. Since the representatives from the existing aviation tank farm operator will be present during the construction work, it is believed it will take less than 5 minutes to isolate the hydrant system. Within such a short period of time, a total of 82.5 m³ of jet fuel will be released. Due to the fact that the hydrant pumps and their pipeworks are bounded by the bund wall, such a small amount of jet fuel will be contained inside the bay and without spilling outside the tank farm.

6.11.3.8 There is a risk that spilled jet fuel, if ignited, may result in construction worker mortality. With such a small construction site, it is estimated that the number of the construction worker present at any one time is a maximum of 10. As discussed in the earlier section, flame spreading on the jet fuel is slow, so there is a high chance of safe escape of the construction workers. The probability of escaping / surviving for the ground crew is assumed to be 95 % ^[2]. However, the environment and condition of the construction site will be different from the flat surface on apron and may not allow easy access and escape, hence a lower escape probability of 70 % is assumed for construction workers.

Underground Pipeline

6.11.3.9 Two scenarios have been considered for the underground pipeline failure and they are 50 mm hole size release and pipeline rupture. The consequence modelling for the 50 mm hole size release follows the same approach for the underground pipeline failure at the third runway during operation stage.

6.11.3.10 Similarly, the consequence modelling for the pipeline rupture follows the same approach for the underground pipeline failure at the third runway during operation stage, except that the maximum jet fuel flow rate would be 71.5 m³/min as the third runway complex has not been in place during the construction phase. The details can be referred to Section 6.12.3.

6.12 Operation Phase (Aviation Fuel)

6.12.1 Frequency Assessment

Submarine Pipeline

6.12.1.1 Different from the existing submarine pipeline, the diverted pipeline will be located more than 50 m below seabed, except the section near Sha Chau and the western side of the airport. At such a depth, most of the pipeline will not be impacted by anchor drop, vessel sink, dredging and the main cause of failure will be corrosion, construction defect and natural hazard such as earthquake. To err on the pessimistic side, the pipeline rupture failure rate of 1.9E-6 per km-yr as proposed in the PAFF study ^[6] is adopted for the current study.

New Hydrant Pump inside Aviation Fuel Tank Farm

6.12.1.2 About six new hydrant pumps, together with piping, will operate in the aviation fuel tank farm. With reference to the OIR12 database, the failure rate of a hydrant pump is 0.005 /yr, so the total pump failure rate is 0.030 /yr. However, the recorded maximum hole size was 13 mm. The failure rate of steel piping with a diameter between 3” and 11” is 4.7E-5 /m/yr ^[46]. Assuming the total length of new piping is 700 m, the overall piping failure rate is 0.0329 /yr. Therefore, the total failure rate of the new pump and piping is 0.0629 /yr (i.e. 0.03 /yr + 0.0329 /yr). The ignition probability is 0.0024 ^[17].

Underground Pipeline

6.12.1.3 The failure frequency of the jet fuel underground pipeline is made reference to the historical pipeline accident database published by the UKOPA. Based on the database, the failure frequency for hole size leakage and full-bore rupture of the pipeline is 2.24E-4 per km-yr and 1.30E-5 per km-yr respectively and the failure causes of product loss from the pipeline from 1962 to 2010 are shown in Table 6‑19. According to the hydrant system designer under the scheme design for the project, the underground pipeline in the apron is surrounded by 5 MPa (50 bar) concrete to a minimum depth of 1.2 m and any jet fuel released from the pipeline (at 11 bar) will spread downwards and sit on top of the water table in the formation. It is extremely unlikely that the released fuel can escape to the surface. Only when the pipeline is damaged by external inference (e.g. digging or drilling on the ground) or ground movement, jet fuel will be released to the ground surface through the hole / fissure in the concrete. From the table, external interference is one of the major causes of pipeline leakage. The failure frequency for hole size leakage and full-bore rupture of the pipeline is therefore adjusted to 3.92E-5 per km-yr and 1.03E-06 per km-yr respectively.

Table 6‑19: Causes of Pipeline Failure ^[35]

Product Loss Cause	No of Incidents
Girth Weld Defect	34
External Interference	40
Internal Corrosion	2
External Corrosion	37
Unknown	7
Other	41
Pipe Defect	13
Ground Movement	7
Seam Weld Defect	3
Total	184

Hydrant Pit Valve

6.12.1.4 Frequency assessment is conducted to quantify the failure frequency of the various hazardous events (fault sequences) identified during the HAZID workshop and from a review of historical incident records for the aircraft refuelling operation. Historical data is the most appropriate source to utilise as it reflects the actual situation within operating environment being analysed. The failure rate data used in the analysis has been based on the collection and analysis of reported spill incidents provided by the fuelling operator of the HKIA.

6.12.1.5 HKIA commenced operations in 1998, since then, there were six reported jet fuel spillage incidents during the aircraft refuelling operation, as detailed in Section 6.9.3 above. The estimated frequency is 0.4 spillage /yr (6 / 15 years).

6.12.1.6 This failure frequency applies to the existing operation of T1. In order to predict the failure frequency for the future operation of third runway, the estimated frequency of 0.4 spillage /yr will be adjusted based on projected number of aircraft refuelling operation for the third runway in 2030. This is calculated using the following formula:

6.12.1.7 According to the information provided by AFSC, there are 320 hydrant pit valves in the existing T1 apron. The total aircraft refuelling operation at 2012 is on average 500 /day. Therefore, the number of daily operation per pit valve for 2012 is 1.56.

6.12.1.8 The number of daily operation for 2030 can be estimated from the projected aircraft movements in 2030. According to the Preliminary Design Report for the project ^[28], the Peak Hour Air Traffic Forecasts indicates that the number of departures in 2010 is 59 /hr, and number of projected departures in 2030 is 102 /hr.

6.12.1.9 According to the initial scheme design report for the project ^[41], there will be a provision of approximately 110 aircraft parking stands in the passenger apron of third runway, in which there are 99 hydrant pits at remote stands and 137 hydrant pits at frontal stands. In addition, there will be 176 hydrant pits to be provided in the midfield concourse which is outside the scope of this study. Therefore, the number of operation per pit valve for 2030 can be estimated as:

6.12.1.10 The spillage frequency during aircraft refuelling operation for Third Runway is calculated as

6.12.1.11 According to historical accident records of the HKIA, overfilling was not identified as the source of jet fuel leakage during aircraft refuelling. However, according to Table 6‑4, jet fuel leakage from aircraft, such as overfilling, can be a source of leakage. A total of seven leakage incidents have been identified in the past 30 years for 33 airports (including HKIA). This is equivalent to a failure rate of 0.0071 per year per airport which is insignificant as compared with the estimated failure rate as shown in Section 6.12.1.10. However, it will be added into the spillage frequency in the current study.

Table 6‑20: Summary of Frequency / Probability of the Identified Scenarios for Operation Phase

Scenario	Frequency
Jet fuel leakage due to submarine pipeline rupture	1.90E-6 per km-year
Jet fuel leakage from new hydrant pump and pipework inside aviation fuel tank farm	0.0629 per year
50mm hole size release of jet fuel leakage from underground pipeline	3.92E-5 per km-year
Jet fuel leakage from underground pipeline rupture	1.03E-6 per km-year
Jet fuel leakage from hydrant pit valve	0.230 per year

6.12.2 Event Tree Analysis

Submarine Pipeline

6.12.2.1 When one of the two submarine pipelines is broken, the automatic isolation system will be activated to stop the supply of jet fuel through the pipeline in 3 minutes ^[6] in order to minimise the loss. However, in case of the failure of the isolation system, a continuous release of 60 minutes is assumed ^[6]. The probability of failure of the automatic isolation system is 0.1 ^[6]. The event tree for the jet fuel leakage from submarine pipeline is shown in Figure 6‑17. The ignition probability is 0.008 ^[6].

Figure 6‑17: Event Tree for Jet Fuel Submarine Pipeline

Table 6‑21: Probability Data for Event Tree Analysis – Submarine Pipeline (refer to Figure 6‑17)

Item	Value	Justification / Reference
Successful automatic isolation	0.9	Ref.: 6

Underground Pipeline

6.12.2.2 When the underground pipeline is damaged, jet fuel will be spilled and such a spillage will continue until someone depresses the emergency stop button. As the apron will be filled with airport staff during normal operating hours, it is assumed that the leakage can be spotted by staff within 3 minutes. The maximum separation distance of ESBs is 75 m, with a running speed of 2.5 m/s ^[30], it shall take approximately 30 seconds to reach the closest ESB and activate the button. The pump and the isolation valve will be shut within 1 minute. Therefore, the overall delay time is estimated to be around 5 minutes. It is assumed that in the worst case it will take 10 minutes to isolate a jet fuel leakage incident. Immediate ignition may lead to flash fire followed by pool fire while delayed ignition may result in pool fire. The length of underground pipeline around the frontal stand and remote stand are 4.978 km and 7.69 km respectively. The event tree for jet fuel leakage from underground pipeline is shown in Figure 6‑18.

Figure 6‑18: Event Tree for Jet Fuel Underground Pipeline

Table 6‑22: Probability Data for Event Tree Analysis – Underground Pipeline (refer to Figure 6‑18)

Item	Value	Justification / Reference
Successful isolation by ESB in 5 min	0.987	Suggested by the AFSC
Immediate Ignition	0.001	OGP database ^[17]
Delayed Ignition	0.0014	OGP database ^[17]
Aircraft with passenger in vicinity to the failed underground pipeline	0.5	50% chance is assumed
Is it a large aircraft	0.635	Ref.:28

Hydrant Pit Valve

6.12.2.3 When jet fuel is spilled from a hydrant pit valve, the operator must inform ACC of the incident immediately and ACC will notify Airport Fire Contingent to dispatch fire appliances to standby at the scene within a response time not exceeding 3 minutes to reach the ends of each runway and other aircraft movement areas. The call-out procedure will become effective upon the observance of any fuel spill arising from the refuelling operation and this will trigger immediate evacuation of any passengers on the aircraft as directed by the on-board flight crews who are specifically trained in this contingency. Immediate actions would be taken by the operator to isolate the leakage by releasing the dead-man switch and pulling the lanyard. According to hydrant system design, these two safety features can isolate the leakage within 5 seconds of activation. If the small amount of jet fuel released in this short period is ignited, the operator will likely be able to combat the resulting fire using readily available portable fire extinguishers installed on the hydrant dispenser or at the airbridge and such a scenario is expected normally to result in no causalities. In case these safety cut off mechanisms do not respond on activation, with fuel leakage continuing, the operator has to run 75 m to depress the fall-back fuel cut of feature – an emergency stop button. At a running speed of 2.5 m/s ^[30], it would take about 30 seconds to reach the nearest stop button. If the depressed emergency stop button fails to work when it is pressed, then the operator has to run further 75 m to depress the next emergency stop button to shut off the fuel supply. As the emergency fuel shutdown system is designed to be failsafe, it is considered that more than one emergency stop button failure at any one time is very remote and the scenario of multiple failures has not been considered. Since the refuelling operator would be engaged with activating the emergency stop button some distance from the leaking hydrant dispenser in this chain of events and given that the jet fuel in the hydrant system is operated at a very high pressure, any ignited spill may be too substantial for the refuelling operator to combat using the nearby available extinguishers once the operator returns from depressing the emergency stop button.

6.12.2.4 Currently, aircraft refuelling operations take place at both frontal and remote stands, both with and without passengers on board. The majority of the refuelling operations will be carried out before passengers board the aircraft, however, refuelling with Jet A1 is generally allowed and is judged to be safe when passengers are boarding, on board or disembarking at airports worldwide, this practice not uncommon to reduce aircraft turnaround times, for example after a period of disrupted operations when a number of aircraft may need to depart as quickly as possible. Quite a common re-fuelling practice is also a practice whereby aircraft operators complete the bulk of fuelling prior to passenger embarkation, however there may be a need to top up the fuel after the take-off weight is confirmed by the captain after passengers and cargo are loaded, taking into account the en-route and other contemporary conditions such as expected congestion at arrival airport, adverse weather conditions, etc. Top-up refuelling would however take less than 10 minutes for long haul flights and just a few minutes for short haul flight and so the duration of risk exposure is very short compared to routine refuelling operations, which can take up to 45 minutes for a large aircraft. A refuelling in-charge is normally appointed by the aircraft operator to coordinate with the Ramp Coordinator and to supervise the refuelling procedures to ensure all precautionary measures are in place. If the refuelling operation happens at a frontal stand, the aircraft will be connected to the passenger terminal by air-bridges. Mobile air steps will, however, be deployed to connect to the aircraft if the fuelling operation is taking place at a remote stand. The event tree for jet fuel leakage from hydrant pit valve is shown in Figure 6‑19 below. Immediate ignition may lead to flash fire followed by pool fire while delayed ignition may result in pool fire.

Figure 6‑21: Fault Tree for Major Spillage due to Failure of Safety Systems

Table 6‑24: Summary of Frequency Breakdown of Events for each Identified Scenario – Operation Phase

Scenario	Frequency (per year)
Submarine Pipeline (refer to Figure 6‑17)
Pool fire from submarine pipeline with immediate isolation	1.64E-07
Pool fire from submarine pipeline with delayed isolation	1.82E-08
Hydrant Pump in Aviation Fuel Tank Farm
Pool fire due to jet fuel leakage from hydrant pump installation inside aviation fuel tank farm	1.51E-04
Underground Pipeline – Frontal Stand (refer to Figure 6‑18)
Flash fire followed by pool fire for hole size release of underground pipeline_5 minutes_with passenger onboard a large aircraft	6.12E-08
Flash fire followed by pool fire for hole size release of underground pipeline_5 minutes _with passenger onboard a small aircraft	3.52E-08
Flash fire followed by pool fire for hole size release of underground pipeline_5 minutes _without passenger onboard	9.64E-08
Pool fire for hole size release of underground pipeline_5 minutes _with passenger onboard a large aircraft	8.56E-8
Pool fire for hole size release of underground pipeline_5 minutes _with passenger onboard a small aircraft	4.92E-08
Pool fire for hole size release of underground pipeline_5 minutes _without passenger onboard	1.35E-07
Jet fuel pool only without ignition	1.92E-04
Flash fire followed by pool fire for hole size release of underground pipeline_10 minutes _with passenger onboard a large aircraft	8.06E-10
Flash fire followed by pool fire for hole size release of underground pipeline_10 minutes _with passenger onboard a small aircraft	4.63E-10
Flash fire followed by pool fire for hole size release of underground pipeline_10 minutes _without passenger onboard	1.27E-09
Pool fire for hole size release of underground pipeline_10 minutes _with passenger onboard a large aircraft	1.13E-09
Pool fire for hole size release of underground pipeline_10 minutes _with passenger onboard a small aircraft	6.48E-10
Pool fire for hole size release of underground pipeline_10 minutes _without passenger onboard	1.78E-09
Jet fuel pool only without ignition	2.53E-06
Flash fire followed by pool fire for rupture of underground pipeline_5 minutes _with passenger onboard a large aircraft	1.61E-09
Flash fire followed by pool fire for rupture of underground pipeline_5 minutes _with passenger onboard a small aircraft	9.26E-10
Flash fire followed by pool fire for rupture of underground pipeline_5 minutes _without passenger onboard	2.54E-09
Pool fire for rupture of underground pipeline_5 minutes _with passenger onboard a large aircraft	2.25E-09
Pool fire for rupture of underground pipeline_5 minutes _with passenger onboard a small aircraft	1.30E-09
Pool fire for rupture of underground pipeline_5 minutes _without passenger onboard	3.55E-09
Jet fuel pool only without ignition	5.06E-06
Flash fire followed by pool fire for rupture of underground pipeline_10 minutes _with passenger onboard a large aircraft	2.12E-11
Flash fire followed by pool fire for rupture of underground pipeline_10 minutes _with passenger onboard a small aircraft	1.22E-11
Flash fire followed by pool fire for rupture of underground pipeline_10 minutes _without passenger onboard	3.34E-11
Pool fire for rupture of underground pipeline_10 minutes _with passenger onboard a large aircraft	2.97E-11
Pool fire for rupture of underground pipeline_10 minutes _with passenger onboard a small aircraft	1.71E-11
Pool fire for hole size release of underground pipeline_10 minutes _without passenger onboard	4.67E-11
Jet fuel pool only	6.67E-08
Underground Pipeline – Remote Stand (refer to Figure 6‑18)
Flash fire followed by pool fire for hole size release of underground pipeline_5 minutes _with passenger onboard a large aircraft	9.46E-08
Flash fire followed by pool fire for hole size release of underground pipeline_5 minutes _with passenger onboard a small aircraft	5.44E-08
Flash fire followed by pool fire for hole size release of underground pipeline_5 minutes _without passenger onboard	1.49E-07
Pool fire for hole size release of underground pipeline_5 minutes _with passenger onboard a large aircraft	1.32E-07
Pool fire for hole size release of underground pipeline_5 minutes _with passenger onboard a small aircraft	7.60E-08
Pool fire for hole size release of underground pipeline_5 minutes _without passenger onboard	2.08E-07
Jet fuel pool only without ignition	2.97E-04
Flash fire followed by pool fire for hole size release of underground pipeline_10 minutes _with passenger onboard a large aircraft	1.25E-09
Flash fire followed by pool fire for hole size release of underground pipeline_10 minutes _with passenger onboard a small aircraft	7.16E-10
Flash fire followed by pool fire for hole size release of underground pipeline_10 minutes _without passenger onboard	1.96E-09
Pool fire for hole size release of underground pipeline_10 minutes _with passenger onboard a large aircraft	1.74E-09
Pool fire for hole size release of underground pipeline_10 minutes _with passenger onboard a small aircraft	1.00E-09
Pool fire for hole size release of underground pipeline_10 minutes _without passenger onboard	2.74E-09
Jet fuel pool without ignition	3.91E-06
Flash fire followed by pool fire for rupture of underground pipeline_5 minutes _with passenger onboard a large aircraft	2.49E-09
Flash fire followed by pool fire for rupture of underground pipeline_5 minutes _with passenger onboard a small aircraft	1.43E-09
Flash fire followed by pool fire for rupture of underground pipeline_5 minutes _without passenger onboard	3.92E-09
Pool fire for rupture of underground pipeline_5 minutes _with passenger onboard a large aircraft	3.48E-09
Pool fire for rupture of underground pipeline_5 minutes _with passenger onboard a small aircraft	2.00E-09
Pool fire for rupture of underground pipeline_5 minutes _without passenger onboard	5.48E-09
Jet fuel pool only without ignition	7.82E-06
Flash fire followed by pool fire for rupture of underground pipeline_10 minutes _with passenger onboard a large aircraft	3.28E-11
Flash fire followed by pool fire for rupture of underground pipeline_10 minutes _with passenger onboard a small aircraft	1.88E-11
Flash fire followed by pool fire for rupture of underground pipeline_10 minutes _without passenger onboard	5.16E-11
Pool fire for rupture of underground pipeline_10 minutes _with passenger onboard a largeaircraft	4.58E-11
Pool fire for rupture of underground pipeline_10 minutes _with passenger onboard a small aircraft	2.63E-11
Pool fire for hole size release of underground pipeline_10 minutes _without passenger onboard	7.22E-11
Jet fuel pool only without ignition	1.03E-07
Hydrant Pit Valve (refer to Figure 6‑19)
Small jet fuel pool only without ignition	1.52E-02
Immediate ignition at frontal stand with isolation by ESB in 30 seconds with passenger and crew members in a large aircraft	8.30E-07
Immediate ignition at frontal stand with isolation by ESB in 30 seconds with passenger and crew members in a small aircraft	4.77E-07
Delay ignition at frontal stand with isolation by ESB in 30 seconds with passenger and crew members in a large aircraft	1.16E-06
Delay ignition at frontal stand with isolation by ESB in 30 seconds with passenger and crew members in a small aircraft	6.68E-07
Jet fuel pool only without ignition	1.30E-03
Immediate ignition at frontal stand with isolation by ESB in 60 seconds with passenger and crew members in a large aircraft	1.09E-08
Immediate ignition at frontal stand with isolation by ESB in 60 seconds with passenger and crew members in a small aircraft	6.29E-09
Delay ignition at frontal stand with isolation by ESB in 60 seconds with passenger and crew members in a large aircraft	1.53E-08
Delay ignition at frontal stand with isolation by ESB in 60 seconds with passenger and crew members in a small aircraft	8.79E-09
Jet fuel pool only without ignition	1.72E-05
Ignition of jet fuel pool at frontal stand with passenger only in the aircraft	0.00E+00
Small jet fuel pool only without ignition	1.69E-03
Immediate ignition at remote stand with isolation by ESB in 30 seconds with passenger and crew members in a large aircraft	9.23E-08
Immediate ignition at remote stand with isolation by ESB in 30 seconds with passenger and crew members in a small aircraft	5.30E-08
Delay ignition at remote stand with isolation by ESB in 30 seconds with passenger and crew members in a large aircraft	1.29E-07
Delay ignition at remote stand with isolation by ESB in 30 seconds with passenger and crew members in a small aircraft	7.42E-08
Jet fuel pool only without ignition	1.45E-04
Immediate ignition at remote stand with isolation by ESB in 60 seconds with passenger and crew members in a large aircraft	1.22E-9
Immediate ignition at remote stand with isolation by ESB in 60 seconds with passenger and crew members in a small aircraft	6.99E-10
Delay ignition at remote stand with isolation by ESB in 60 seconds with passenger and crew members in a large aircraft	1.70E-09
Delay ignition at remote stand with isolation by ESB in 60 seconds with passenger and crew members in a small aircraft	9.77E-10
Jet fuel pool only without ignition	1.91E-06
Ignition of jet fuel pool at remote stand with passengers only in the aircraft	0.00E+00
Small jet fuel pool only without ignition	7.01E-02
Immediate ignition at frontal stand with isolation by ESB in 30 seconds with crew members only in or near a large aircraft	3.82E-06
Immediate ignition at frontal stand with isolation by ESB in 30 seconds with crew members only in or near a small aircraft	2.20E-06
Delayed ignition at frontal stand with isolation by ESB in 30 seconds with crew members only in or near a large aircraft	5.34E-06
Delayed ignition at frontal stand with isolation by ESB in 30 seconds with crew members in or near a small aircraft	3.07E-06
Jet fuel pool only without ignition	6.00E-03
Immediate ignition at frontal stand with isolation by ESB in 60 seconds with crew members only in or near a large aircraft	5.03E-08
Immediate ignition at frontal stand with isolation by ESB in 60 seconds with crew members only in or near a small aircraft	2.89E-08
Delayed ignition at frontal stand with isolation by ESB in 60 seconds with crew members only in or near a large aircraft	7.04E-08
Delayed ignition at frontal stand with isolation by ESB in 60 seconds with crew members only in or near a small aircraft	4.05E-08
Jet fuel pool only without ignition	7.91E-05
Ignition of jet fuel pool at frontal stand without people in or near aircraft	1.14E-01
Small jet fuel pool only without ignition	7.79E-03
Immediate ignition at remote stand with isolation by ESB in 30 seconds with crew members only in or near a large aircraft	4.24E-07
Immediate ignition at remote stand with isolation by ESB in 30 seconds with crew members only in or near a small aircraft	2.44E-07
Delayed ignition at remote stand with isolation by ESB in 30 seconds with crew members only in or near a large aircraft	5.94E-07
Delayed ignition at remote stand with isolation by ESB in 30 seconds with crew members only in or near a small aircraft	3.41E-07
Jet fuel pool only without ignition	6.67E-04
Immediate ignition at remote stand with isolation by ESB in 60 seconds with crew members only in or near a large aircraft	5.59E-09
Immediate ignition at remote stand with isolation by ESB in 60 seconds with crew members only in or near a small aircraft	3.21E-09
Delayed ignition at remote stand with isolation by ESB in 60 seconds with crew members only in or near a large aircraft	7.82E-09
Delayed ignition at remote stand with isolation by ESB in 60 seconds with crew members only in or near a small aircraft	4.49E-09
Jet fuel pool only without ignition	8.78E-05
Ignition of jet fuel pool at remote stand without people in or near aircraft	1.27E-02

6.12.3 Consequence Analysis

Pool Fire

6.12.3.1 Pool fires occur when a flammable liquid is spilled onto a surface and is ignited. In this study, pool fire effect due to the leakage of jet fuel will be discussed.

Jet Fuel Leakage in Sea

6.12.3.2 The new submarine pipeline will be buried more than 50 m below seabed and it will climb up to connect to the existing facility in Sha Chau and HKIA. Because of the depth of the pipelines, any spilled jet fuel will not be able to penetrate the seabed and release to the sea directly. If the submarine pipelines are ruptured, the jet fuel will first be released from the pipeline and flow along the space between the pipeline and the bore. The bore is in the order of 200 mm larger than the diameter of the submarine pipeline and it is anticipated to be filled with bentonite. There would be a chance of release to the sea via the Sha Chau landfall or via the HKIA pipe receiving area.

6.12.3.3 The total volume of fuel released depends on the flow rate of the jet fuel inside the pipelines and the time required for the fuel leakage detection system to shut down the fuel pumps at the Sha Chau. In the Hazard to Life Assessment for the PAFF [6], the shut down response time for the fuel pump was assumed to be 3 minutes if the detection system functions properly, however the time increased to 60 minutes by manual isolation in the event that the integrated detection system failed.

6.12.3.4 Since the flow rate of jet fuel inside the submarine pipeline is 1,500 m³/hr, 75 m³ of jet fuel would be released into the sea if the fuel pump can be stopped in 3 minutes and this is equivalent to a pool radius of 49 m and thickness of 10 mm ^[6]. However the released quantity will be increased to 1,500 m³ if it takes 60 minutes to isolate the leakage and a jet fuel pool of radius of 219 m with a thickness of 10 mm ^[6]will be formed. Besides, the remaining content of pipeline (1178 m³) may continue to leak out the broken pipeline due to depressurisation.

Jet Fuel Leakage inside Aviation Fuel Tank Farm due to new Hydrant Pump/Piping Failure

6.12.3.5 When jet fuel is released from the hydrant pump / piping, it will be accumulated inside the bund wall which is at least 30 m from the nearest public road (i.e. Scenic Road). The maximum flow rate of each hydrant pump is 5.5 m³/min. Considering a hydrant pump / piping failure with a continuous jet fuel release of 10 minutes, about 55 m³ of jet fuel will be released and this will be contained inside the bund wall. The average surface emissive power of large Jet A-1 fire is 10 kWm^-2 and under this thermal radiation level, the fatality rate is less than 1 % for about 40 seconds exposure time. Since the nearest public road is more than 30 m away, the surface emissive power will be lower than 10 kWm^-2 and the fatality rate will be much smaller than 1 %. Therefore, the offsite risk will be insignificant.

Jet Fuel Leakage from Underground Pipeline and Hydrant System

6.12.3.6 When the jet fuel arrives at HKIA, it will be transferred to the storage tanks at the AFTF through underground pipeline. In order to transfer fuel to an aircraft, fuel pumps at the tank farm will pump the jet fuel from the storage tank to aircraft parking stand through the hydrant system.

6.12.3.7 In case there is a spillage of jet fuel from the underground pipeline and hydrant system, it will spread over the apron or taxiway. Similar to the fuel spillage on sea, the extent of the spillage depends on the time required to isolate the fuel supply by operating staff and the flow rate of jet fuel in the pipeline and hydrant system. The thickness of the circular jet fuel pool was assumed to be 20 cm in the previous QRA study ^[10], however, this is considered quite deep if it is just a small spill. In this study, the following empirical formula will be used to estimate the radius of a pool for an isolated release ^[16]:

where, V is volume of fuel spilled (m³).

Jet Fuel Release from Hydrant Pit Valve

6.12.3.8 Based on the hydraulic model developed by the aviation fuel hydrant system designer using the software Fluid Flow 3 (v.3.20.5), the jet fuel release rate through the hydrant pit valve is 7.4 m³/min in case of complete rupture of the pit valve. When the hydrant pump is stopped after depressing the emergency stop button, which is located about 75 m away from the hydrant pit valve, a certain amount of jet fuel will keep releasing out of the broken valve until the pipeline is depressurized (i.e. the set depressurization quantity). According to the hydrant system designer, the set depressurization quantity is 10 m³. Therefore, the total released quantity can be calculated as follows:

where,

V_{hydrant pit} is the volume of fuel spilled from hydrant pit valve (m³)

Δt is the release duration (min)

6.12.3.9 Under the influence of strong wind, the liquid pool may be dragged in the direction of wind. The diameter of the pool under the maximum wind speed of 7 m/s can be estimated using PoolFire6 and the results are summarised in Table 6‑25:

Table 6‑25: Dragged Diameter of Pool Fire - Hydrant Pit Valve

Isolation Time (s)	Volume of Jet Fuel Released (m³)	Dragged Diameter Under 7 m/s Wind Speed (m)
Isolation Time (s)	Volume of Jet Fuel Released (m³)
30	14	57
60	17	63

Underground Jet Fuel Pipeline – Hole Size Release

6.12.3.10 If there is a 50 mm hole in the underground pipeline, jet fuel will be released at a flow rate of 4.6 m³/min, which is obtained from the same hydraulic model, at an operating pressure of 11 bar. The total amount of jet fuel spilled depends on the release duration and the set depressurization quantity and it can be calculated as follows:

V_{pip_50} is the volume of fuel spilled from a 50 mm hole in the underground pipeline (m³)

Δt is the time taken to depress the emergency stop button (min)

6.12.3.11 Under the influence of strong wind, the liquid pool may be dragged in the direction of wind. The diameter of the pool under the maximum wind speed of 7 m/s can be estimated using PoolFire6 and the results are summarised in Table 6‑26:

Table 6‑26: Dragged Diameter of Pool Fire - Hole Size Release from Underground Pipeline

Isolation Time (min)	Volume of Jet Fuel Released (m³)	Dragged Diameter Under 7 m/s Wind Speed (m)
Isolation Time (min)	Volume of Jet Fuel Released (m³)
5	33	82
10	56	101

Underground Jet Fuel Pipeline – Rupture

6.12.3.12 When the third runway apron is in place, the maximum flow rate of the underground pipeline is 102 m³/min and it allows an approximate of 26 into-plane filling operations at the same time at a flow rate of 3.85 m³/min each. According to the data provided by the AFSC, there are currently 500 aircraft refuelling operations taking place in each day (i.e. 21 operations /hr). Considering the fact that there are 268 aircraft stands in total in the airport by 2030 with 100 new air stands in the new apron near the third runway, there will be proportionally eight aircraft refuelling operations taking place in the new apron near the third runway while the remaining 13 operations will take place at T1 and the Midfield concourse.

6.12.3.13 As the underground aviation fuel hydrant pipeline circulates jet fuel to the T1 and Midfield concourse first before going to the new apron near the third runway, the fuelling operations taking place at the T1 and Midfield concourse will consume some of the circulating jet fuel and this reduces the amount of jet fuel available to the new apron and this can be estimated as:

V_apron = 102 – 13 * 3.85 = 51.95 m³/min

6.12.3.14 If the underground pipeline is rupture, the maximum jet fuel flow rate spilling to the surface is, therefore, 51.95 m³/min. The total amount of jet fuel spilled depends on the release duration and the set depressurization quantity and it can be calculated as follows:

6.12.3.15 Under the influence of strong wind, the liquid pool may be dragged in the direction of wind. The diameter of the pool under the maximum wind speed of 7 m/s can be estimated using PoolFire6 and the results are summarised in Table 6‑27:

Table 6‑27: Dragged Diameter of Pool Fire - Rupture of Underground Pipeline

Isolation Time (min)	Volume of Jet Fuel Released (m³)	Dragged Diameter Under 7 m/s Wind Speed (m)
Isolation Time (min)	Volume of Jet Fuel Released (m³)
5	270	196
10	530	258

Flash Fire

6.12.3.16 During refuelling operation, the pressure between the hydrant pit valve and the hydrant dispenser is about 11 bar and the pressure between the hydrant dispenser and the aircraft fuel tank is about 3 bar. Therefore, it is reasonable to assume that in the event of failure resulting in a mist or spray being formed, it is likely to be flammable. However, if a flammable spray is generated and ignited, it is more likely to result in a flash fire followed by a pool fire ^[9]. In case of jet fuel leakage from hydrant pit valve during aircraft refuelling, aerosol droplet will be formed to cause potential flash fire. After a few seconds, the droplets will either be diluted by air or condense back to form a liquid pool if they are not ignited immediately. The size of the flash fire is modelled using the software PHAST.

Vapour Cloud Explosion due to Jet Fuel

6.12.3.17 Health and Safety Executives (UK) defines the vapour cloud explosion as a cloud of vapour which when ignited cannot expand freely results a significant overpressure and explosion ^[14]. As jet fuel has low flash fraction at ambient temperature, the flammable vapour generated above the liquid surface of jet fuel will be much lower than the Lower Flammable Limit (LFL), and hence vapour cloud explosion is unlikely to occur. This is in line with the argument made in the Hazard to Life study for the PAFF ^[6].

6.12.3.18 This is also stated in the QRA study for aircraft fuelling operations ^[2] that the possibility of explosions generated by Jet A-1 fuel following a spill is very small. It would require the leakage of fuel at a temperature above its flashpoint into a confined area, and with a powerful ignition source. Given that these conditions are unlikely to occur in the current fuel hydrant system and storage facilities, the consequence of vapour cloud explosion is not considered.

Smoke

6.12.3.19 The major component of jet fuel is kerosene which is a long chain of hydrocarbon. Unlike other flammable hydrocarbons such as natural gas and LPG, incomplete combustion will occur and thick black smoke will be generated. The smoke contains, for example, carbon monoxide and sooty particles which can cause health impact in the area covered by the smoke. The dispersion of smoke in the downwind direction can be estimated by using ALOFT-FTTM model.

6.12.3.20 The Smoke Plume Trajectory Model ALOFT-FTTM (A Large Outdoor Fire Plume Trajectory model – Flat Terrain), which was created by the National Institute of Standards and Technology of the U.S. Department of Commerce, is a computer based model to predict the downwind concentration (mg/m³) of smoke particulate and combustion products from large outdoor fires happening in a flat terrain. The model applies fundamental Navier-Stokes equation using an eddy viscosity over a uniform grid which spans the smoke plume and its surroundings. The model inputs include wind speed and variability, atmospheric temperature profile, fuel parameters and emission factors.

Table 6‑28: Model Input Parameters

Parameter	Value	Reference
Wind Speed	7 m/s	Base on the highest wind speed obtained from the Sha Chau weather station
Atmospheric Stability	D	Base on stability class for the highest wind speed obtained from the Sha Chau weather station
Heat Release Rate	1.7 MW/m²	Ref.: [29]
Radiative Fraction	0.1	With reference to the built in data from the ALOFT software for Alaska North Slope Crude oil
Burning Rate per Unit Area	0.039 kg/m²-s	Ref.: [29]
Emission Factor of Carbon Monoxide	30 g/kg	With reference to the built in data from the ALOFT software for Alaska North Slope Crude oil

6.12.3.21 As the smoke layer is hot, it is buoyant and tends to move upward in the atmosphere. Therefore, it is unlikely to impact the people standing on ground level but it may affect people living and working above the ground level. The height of the smoke plume at various distances from the burning jet fuel pool fire obtained from the ALOFT-FTTM and it is used to assess whether the buildings inside the airport would be affected by the smoke.

6.12.3.22 The carbon monoxide component contained in the smoke is toxic and it is known to cause the majority of deaths in a fire ^[13]. Therefore, the probability of fatality caused by smoke depends on the concentration of carbon monoxide and exposure time. By applying the following probit equation ^[12], the probability of fatality can be evaluated:

where,

C is carbon monoxide concentration (ppm)

t is time of exposure (min)

6.12.3.23 The software has been used to model jet fuel pool fire with a size of 250 m² which is equivalent to a pool radius of 9 m. At a height of 12 m with a wind speed of 7 m/s, the maximum concentration of carbon monoxide is less than 20,000 µg/m³ (i.e. 16.2 ppm) occurring at a distance of 50 m downwind which is approximately the distance between the passenger boarding gate and the hydrant pit valve. Under this concentration, the probability of fatality is zero for an exposure time of 120 minutes which is sufficient to evacuate the passenger away from the boarding gate.

6.12.3.24 The model has been rerun for jet fuel pool fire with a size of 1,000 m² which is equivalent to a pool radius of 18 m. At a height of 12 m with a wind speed of 7 m/s, the maximum concentration of carbon monoxide is less than 30,000 µg/m³ (i.e. 24.3 ppm) occurring at a distance of 50 m downwind which is approximately the distance between the passenger boarding gate and the hydrant pit valve. Under this concentration, the probability of fatality is also zero for an exposure time of 120 minutes which is sufficient to evacuate the passenger away from the boarding gate. Therefore, burning of the small amount of spilled jet fuel during the aircraft refuelling operation is unlikely to generate a concentration of carbon monoxide that is high enough to affect the passengers inside the building.

6.12.3.25 The pool fire size due to jet fuel release from the underground pipeline is 26,019 m² for release duration of 10 minutes at a wind speed of 7 m/s. Due to the limitation of the software, any fire size larger than 1,000 m² cannot be modelled. In order to estimate the carbon monoxide concentration for this large scale of release, a linear proportion technique is adopted based on the findings from 250 m² and 1,000 m² pool fire size and the concentration is estimated to be 295 ppm up to at a height of 12 m. Under this concentration, the probability of fatality is zero for an exposure time of 120 minutes, using the probit equation as shown in Section 6.12.3.22, which is sufficient to evacuate the passenger away from the boarding gate.

6.12.4 Fatality Rate Estimation

6.12.4.1 In case there is a jet fuel leakage at the hydrant pit valve, the operator can release deadman switch and lanyard to isolate the release and the isolation can be achieved within 5 seconds. Within such a short period of time, only a very small amount of jet fuel will be released and it is considered non-hazardous to the onboard passengers and other ground crew members.

6.12.4.2 However, when the deadman switch and lanyard are not operative, the operator will have to depress emergency stop button (ESB) which is located 75 m away from the hydrant pit valve. Once the ESB is depressed, the hydrant pump will be shut down in less than 5 seconds. At a normal running speed of 2.5 m/s ^[30], it will take about 30 seconds to depress the ESB. In order to take into account of the possibility of failure of the ESB, it is assumed that in the worst case the operator will have to depress two ESBs to have a successful isolation of the hydrant system. The total time taken for an operator to depress two consecutive emergency stop buttons (ESB) is about 60 seconds (assuming the 1st does not respond upon activation). After depressing the ESB, the hydrant pump will be stopped within 5 seconds and a total of 10 m³ of residual jet fuel inside the pipeline will be released before the leakage will stop and it will take about 1.35 minutes (10 m³ / 7.4 m³/min) for the residual fuel to release.

6.12.4.3 Based on the hydraulic model developed by the aviation fuel hydrant system designer using the software Fluid Flow 3 (v.3.20.5), the jet fuel release rate through the hydrant pit valve is 7.4 m³/min in case of complete rupture of the pit valve. When jet fuel is released and immediately ignited, a liquid pool will be formed and the ignition of the liquid pool will form a circular pool fire. However, the flame will be dragged in the shape of ellipse under an influence of wind. The radius of the liquid pool is estimated by using the formula stated in Section 6.12.3.7 while the flame dragged diameter is estimated by using the software PoolFire6. A summary of the flame size is shown in Table 6‑29 below.

Table 6‑29: Summary of Flame Size at Different Release Duration

Release Duration (s)	Quantity Released (m³)	Dragged flame downwind radius under wind speed of 7 m/s (m)	Dragged flame crosswind radius under wind speed of 7 m/s (m)
50	6.2	20.5	15.5
90	11.1	26	20
120	14.8	29	22.5
146*	18.0	32	25

Remark: * The maximum duration of jet fuel release after complete depressurization of the hydrant system.

6.12.4.4 When passengers remain on board during refuelling process, the area below the aircraft doors shall be cleared to enable the deployment of emergency chutes (Photo 6‑18), according to the Airport Operations Manual, a clear zone of 2 m x 5 m for small aircraft and 3 m x 10 m for large aircraft shall be provided. In addition, the same number of airbridges or aircraft steps as normally used for passenger disembarkation must be positioned at the doors and opened. Cabin staff must be stationed at each door throughout the period of refuelling to direct emergency evacuation if the need arises. Communications shall be maintained by aeroplane intercommunications system or other suitable means between the refuelling in charge and the pilot ^[²⁷^].

Photo 6‑18: Deployment of Inflatable Slide

Frontal Stand with Airbridge

6.12.4.5 Currently, aircraft refuelling operations can take place at frontal and remote stands. During any fuelling operation with passengers onboard when an aircraft is at a frontal stand, the same number of airbridges as normally used for passenger embarkation / disembarkation must be positioned at the doors and kept open ^[27]. If there were a jet fuel leakage or pool fire happening on the ground during the refuelling process, the passengers and the flight crew onboard the aircraft would be substantially protected by the aircraft fuselage and those on board are most likely to escape through the connected airbridge(s). The probabilities for escaping / surviving to be adopted in this study therefore makes reference to the previous QRA studies for aircraft fuelling operations ^[2] and as shown in Table 6‑30. The probability of escape for persons onboard the aircraft were estimated based on the assumption that persons nominally within the affected area but inside the aircraft will be afforded some protection by the aircraft (i.e. they are not directly exposed to thermal radiation or fire during evacuation) and thus are likely to be able to escape relatively easily.

Table 6‑30: Probability of Escaping/Surviving for Person in Affected Area (Airbridges connected to Aircraft)

Population Group	Probability (%)
Ground crew	95
Cabin/flight crew	99
Passenger	99

Remote Stand with Mobile Aircraft Steps

6.12.4.6 Again, a small size aircraft (A320 by Airbus) and a large size aircraft (A340-500 by Airbus) have been considered in estimating the probability of escape when an aircraft is at a remote stand, with persons boarding the aircraft using mobile aircraft steps. In the event of a pool fire or flash fire passengers would need to use the exposed aircraft emergency exits or the similarly exposed emergency exit chutes that provide far less protection compared to an enclosed airbridge connection at frontal stands.

6.12.4.7 According to Item C of 14 CFR25.803 Emergency Evacuation of the Federal Aviation Regulation, which is also the regulatory requirement for airlines in Hong Kong, for airplanes having a seating capacity of more than 44 passengers, it must be shown that the maximum seating capacity, including the number of crew members required by the operating rules for which certification is requested, can be evacuated from the airplane to the ground under simulated emergency conditions within 90 seconds. Compliance with this requirement must be shown by actual demonstration using the test criteria outlined in Appendix J of this part unless the Administrator finds that a combination of analysis and testing will provide data equivalent to that which would be obtained by actual demonstration. Aircraft evaluation certification is legislated by the Joint Aviation Regulations in Europe or the Federal Aviation Regulations in the USA. The regulation requires the test to be done with the aircraft loaded with the maximum passenger capacity and with half of the emergency doors being closed, With reference to the design of Airbus A340-500, there is a maximum passenger capacity of 313 with eight emergency exit doors (four on each side). The escape rate for each emergency exit is therefore 0.897 person/s (i.e. (313+10) passengers / 4 exit doors / 90 s) with an assumption that there are 10 flight crew members onboard. For a small aircraft of Airbus A320, there is a maximum 180 passengers with six emergency exit doors (three on each side). The escape rate for each emergency exit is therefore 0.689 person/s (i.e. (180+6) passengers / 3 exit doors / 90 s) with an assumption that there are six flight crew members.

Case 1 – Small Aircraft (Airbus A320)

6.12.4.8 The capacity of the aircraft is 180 passengers and it is assumed to have six flight crew members per flight and 10 catering / cleaning workers during the turnaround. The average load (i.e. occupancy) per flight at peak hour in 2030 is estimated as 85 % ^[28]. Refuelling operation while passengers are on board the aircraft could occur when (i) the turnaround time is short and passengers are allowed to embark or disembark the aircraft during refuelling; and (ii) an aircraft landing in HKIA for transit operation and some passengers disembark while others remaining in the aircraft for refuelling and departure to other destination. In either case, announcement will be made on board to alert passengers of aircraft refuelling and passengers are reminded not to put on the seat belt and no smoking or ignition source is allowed. As not all the passengers will be on board the aircraft during the refuelling operation, it is assumed that 90 % of passengers will be present at the time of the refuelling operation. Therefore, there will be a total of 154 persons inside the aircraft including the crew members.

6.12.4.9 There are four normal exit doors and two emergency exits in the aircraft, with three on each side as shown in Figure 6‑22 below. The normal exit door can also be used for emergency exit by deploying an inflatable slide (chute) in case of emergency and it can be deployed within 5 seconds. In case of fuel leakage, the jet fuel pool will gradually develop to a size as shown in Table 6‑29 above (refer to the dotted circle line in Figure 6‑22). Assuming immediate ignition, the pool fire coupled with the worst case wind effect (i.e. blowing to the direction of the emergency exits) will render some of the exits unusable. This is shown by the blue, yellow and green contours in Figure 6‑22 and Figure 6‑23 which has considered the flame drag effect under maximum wind speed of 7 m/s. Figure 6‑22 shows the release after 50 seconds and at least two emergency exits will still be available under different wind directions, and Figure 6‑23 shows the release after 90 seconds in which all the emergency exits will be virtually unusable.

6.12.4.10 In case there is a jet fuel leakage with immediate ignition, the refuelling operator will immediately inform the pilot through the established communication channel. The pilot will initiate an emergency evacuation and inform the apron control centre. Rescue and fire fighting vehicle will be dispatched immediately (even the pool is not ignited in real situation) through the apron control centre. The ignited pool fire will gradually spread from the pit valve to the aircraft at a flame spread rate of 0.5 m/s, assuming ignition occurs at the source. As the crew members are highly trained to respond to emergency situation and they will be stationed at each door throughout the period of refuelling to direct emergency evacuation, also the air stand(s) as used for normal embarking / disembarking will be positioned for evacuation during refuelling operation, the reaction time is estimated to be 20 seconds for the first onboard passenger to start evacuation. For the first 0 seconds – 50 seconds, at least two emergency exits will be available for passenger evacuation. For an escape rate of 0.689 person/s per exit, about 41 persons will be able to escape to ground level and away from the fire. The surface emissive power of large jet fuel fire is 10 kWm^-2 ^[10] and at this thermal flux level, the fatality rate is 1 % for an exposure time of 45 seconds. There will be some distances between the flame and the unaffected emergency exit(s), the thermal flux level at the emergency exit will be less than 10 kWm^-2 and the passengers can move away from the fire swiftly and thus the exposure time will be much less than 45 seconds, hence the fatality rate is much lower than 1 % and it can be assumed that the passengers managed to escape to ground level will be free from injury. From 50 seconds to 90 seconds, one emergency exit will be available and 28 passengers will be able to escape. From 90 seconds onward, the whole aircraft will be engulfed by the spread of pool fire under the worst case wind conditions, and the remaining 85 passengers and crew members will be trapped inside the aircraft.

6.12.4.11 Research conducted by the FAA indicated that if the fuselage is intact, the sidewall insulation will maintain a survivable temperature inside the cabin until the windows melt in approximately 3 minutes. The jet fuel pool fire in real situation will not be as severe as the large external fuel fire scenario in the FAA test. With the assistance of flight crews, passengers will attempt to move to sections of the aircraft where the temperature is lower. Currently, the Airport Fire Contingent can achieve the response time of 2 minutes, not exceeding 3 minutes to reach the ends of each runway and other aircraft movement areas, upon receipt of an emergency call relating to an aircraft accident and they are equipped with suitable spill / fire control equipment and materials such as foam compound to combat jet fuel fire. This is considered achievable for the new aprons located at the third runway as two new fire stations will be provided, one at the east and one at the west side of the aprons (refer to Figure 6‑24 and Figure 6‑25). Based on the analysis, most of the passengers trapped inside the aircraft will survive in the fire incident. However, some vulnerable passengers such as young children (0 to 5 years old) and elderly person (age 80 to 84 years old) may be incapacitated with a relatively higher temperature. In Hong Kong, males account for 46.5 % of the Hong Kong population in 2012 ^[47]. Since the life expectancy of males and females are 80.6 and 86.3 respectively in 2012 ^[47], the average life expectancy is 84. In addition, 5.9 % of the population is of the age between 0-14 and 6.4 % for age 65 and above ^[47]. By using linear approximation, there are 2.1 % (5.9/145) of population with age 0-5 years old and 1.3 % (6.4/(84-65)(84-80)) for age between 80 to 84. In addition, it is assumed that there are, in average, 3 onboard passengers with mobility difficulty (e.g. disabled, injured or impaired mobility requiring wheelchair assistance in airport terminal) who may not be able to escape to the section with a lower temperature and, as a result, suffer fatality injury. The passengers with mobility difficulty accounts for 1.9 % (i.e. 3/154) of the onboard passengers. It is, therefore, conservatively assumed that 5.3 % (i.e. 2.1% + 1.3% +1.9%) of the remaining passengers are vulnerable persons and they will be killed. This is equivalent to 5 persons (i.e. 85 * 5.3 %).

6.12.4.12 The Probability of Escaping / Surviving for Cabin / Flight Crew and Passenger is therefore 96.8 % ((154 –5) / 154).

Figure 6‑22: Airbus A320 – Pool fire size after 50s of release with wind speed of 7 m/s

Point of Leakage

Figure 6‑23: Airbus A320 – Pool fire size after 90s of release with wind speed of 7 m/s

Figure 6‑24: Location of Existing Fire Stations

Figure 6‑25: Location of New Fire Stations

Case 2 - Large Aircraft (Airbus A340-500)

6.12.4.13 The capacity of the aircraft is 313 passengers and it is assumed to have 10 flight crew members per flight and 10 catering / cleaning workers in the turnaround. The average load (i.e. occupancy) per flight at peak hour in 2030 is estimated as 85 % ^[28]. During transit or passenger embarkation for departure, not all the passengers will be on board the aircraft during the refuelling operation, it is assumed that 90 % of passengers will be present at the time of the refuelling operation. Therefore, there will be 260 persons inside the aircraft including the crew members.

6.12.4.14 There are four normal exit doors and four emergency exits in the aircraft, with four on each side as shown in Figure 6‑26 below. The normal exit door can also be used for emergency exit by deploying an inflatable slide (chute) in case of emergency and it can be deployed within 5 seconds. In case of fuel leakage, the jet fuel pool will gradually develop, refer to the dotted circle line in Figure 6‑26 to Figure 6‑28. Assuming immediate ignition, the pool fire coupled with the worst case wind effect (i.e. blowing to the direction of the emergency exits) will render some exits unusable. This is shown by the blue, yellow and green contours in Figure 6‑26 to Figure 6‑28 which has considered the flame drag effect under maximum wind speed of 7 m/s.

6.12.4.15 In case there is a jet fuel leakage with immediate ignition, the refuelling operator will immediately inform the pilot through the established communication channel. The pilot will initiate an emergency evacuation and inform the aircraft control centre. Rescue and fire fighting vehicle will be dispatched immediately (even the pool is not ignited in real situation). The ignited pool fire will gradually spread from the pit valve to the aircraft at a flame spread rate of 0.5 m/s, assuming ignition occurs at the source. As the crew members are highly trained to respond to emergency situation, the reaction time is estimated to be 20 seconds for the first onboard passenger to start evacuation. Using an escape rate of 0.897 person/s per exit, the following table presents the number of exits available for persons to evacuate.

Table 6‑31: Time Interval vs Number of Passengers / Crew Evacuation

Time Interval	Figure No.	No. of Emergency Exits Available	No. of Passengers / Crew able to Escape
0 - 50 seconds	Figure 6‑26	3*	81
50 – 90 seconds	Figure 6‑27	2*	72
90 – 120 seconds	Figure 6‑28	1*	27

Note (*): One emergency exit on the starboard side of aircraft is discounted as it leads passengers to the pool fire or potentially blocked by clustered vehicle / equipment.

6.12.4.16 The surface emissive power of large jet fuel fire is 10 kWm^-2 ^[10] and at this thermal flux level, the fatality rate is 1 % for an exposure time of 45 seconds. There will be some distances between the flame and the unaffected emergency exit(s), the thermal flux level at the emergency exit will be less than 10 kWm^-2 and the passengers can move away from the fire swiftly and thus the exposure time will be much less than 45 seconds, hence the fatality rate is much less than 1 % and it can be assumed that the passengers managed to escape to ground level will be safe.

6.12.4.17 The absence of vision may delay or prevent escape from fires and cause people to be trapped and exposed to the heat and smoke for unacceptable long period of time. According to the test results, the cabin will become totally obscured by smoke within 2 minutes, hence, the people still remaining on board after 2 minutes will have difficulty escaping even if one of the escape routes may be still available for use. As a result, a total of 180 passengers and crew members are able to escape, while 80 persons remain trapped on the aircraft.

6.12.4.18 Taking into account the fire test results as discussed above, the percentage of fatality for people trapped in the aircraft after 4 minutes is 4.6 %. The Probability of Escaping / Surviving for Cabin / Flight Crew and Passenger is therefore 98.6 % ((260 – 80 x 0.046) / 260).

Table 6‑32: Probability of Escaping / Surviving for Person in Affected Area (With Aircraft Stands connected to Small Aircraft)

Population Group	Probability (%)
Ground crew	95
Cabin / flight crew	96.8
Passenger	96.8

Table 6‑33: Probability of Escaping / Surviving for Person in Affected Area (With Aircraft Stands connected to Large Aircraft)

Population Group	Probability (%)
Ground crew	95
Cabin / flight crew	98.6
Passenger	98.6

Figure 6‑26: Airbus A340 – Pool fire size after 50s of release with wind speed of 7 m/s

Figure 6‑27: Airbus A340 – Pool fire size after 90s of release with wind speed of 7 m/s

Figure 6‑28: Airbus A340 – Pool fire size after 120s of release with wind speed of 7 m/s

Escalation Impact

6.12.4.21 The air temperature in the cargo compartment at both the AFT and Forward sections remained at ambient temperature as long as flame penetration into the fuselage has not happened ^[29]. According to the latest Federal Aviation Regulation, item b of subpart D, CFR25.856 Thermal / Acoustic Insulation Materials, for airplanes with a passenger capacity of 20 or greater, thermal / acoustic insulation materials (including the means of fastening the materials to the fuselage) installed in the lower half of the airplane fuselage must not allow fire or flame penetration in less than 4 minutes. Therefore, the temperature at the lower part of the aircraft fuselage will likely remain at ambient temperature within 4 minutes. Since the Airport Fire Contingent can arrive on site within 3 minutes after the incident, it is not likely for the external fire to have escalation impact other than the pool fire affecting the passenger inside the aircraft.

6.12.5 Delayed Ignition

6.12.5.1 For delayed ignition, it is assumed that ignition of fuel will occur after the jet fuel pool is fully developed. As discussed in Section 6.12.4 and Table 6‑29, the maximum duration of jet fuel release after complete depressurization of the hydrant system is 146 seconds assuming that the operator has to press the 2^nd ESB to isolate the fuel supply. Hence, passengers can escape within this period before exposing to fire.

6.12.5.2 For the case of aircraft connected with airbridges, the airbridges can provide some protection to the passengers and crew members during evacuation, it is therefore expected that the survival probability will be the same if not better than the scenario of immediate ignition as shown in Table 6‑30 above, hence the survival probability is conservatively assumed to be 99 %.

6.12.5.3 For the case of aircraft connected with mobile aircraft step, the escape rate for small aircraft is 0.689 person/s per exit and large aircraft is 0.897 person/s per exit. Assume the response time for passengers is 20 seconds and half of the emergency exits for both small and large aircraft will be available for escape, it will take 90 seconds for all the passengers and staff to escape for the case of small aircraft, and also 90 seconds for the case of large aircraft. Therefore, all the persons should be able to escape before the pool fire started to ignite. However, the survival probability is conservatively assumed to be 99 %.

6.13 Operation Phase (Airside Vehicle Fuel)

6.13.1 Frequency Assessment

6.13.1.1 The most credible causes of petrol being released in the airside vehicle filling station are due to failure of road tanker and its flexible delivery hose, underground storage tank and underground pipework. Due to the fact that petrol vapour is heavier than air, it tends to sink to the lowest possible level after an accidental release. Since the petrol storage tank and delivery pipe would be installed underground, any release of petrol liquid would be contained underground and it would not be likely to come into contact with potential ignition source. Therefore, it was conducted in the Kai Tak Development (KTD) QRA study that spillage from storage tank and delivery pipe would not cause off site fatality.

6.13.1.2 In 2012, a total of 647,000 litres of petrol was consumed by the three existing airside vehicle filing stations, with each station having one petrol storage tank. This is equivalent to a consumption of 591 litres (i.e. 647,000 / 3 / 365) of petrol in each station in each day. According to HKIA, all petrol storage tanks are refilled in each day and this practice will be maintained. Considering the small daily petrol consumption rate, the petrol tanker can complete each refilling within 20 minutes. The failure rates of the petrol road tanker and flexible delivery hose to be adopted in the current study are made reference to international historical accident databases and they are shown in Table 6‑34.

Table 6‑34: Failure Rate for Petro Road Tanker and Flexible Delivery Hose

	Failure Rate	Unit	Source of Reference
Road Tanker
Catastrophic failure	1.00E-05	per tanker per year	Ref.: [34]
Partial failure (50mm)	5.00E-07	per tanker per year	Ref.: [34]
Flexible Delivery Hose
Guillotine failure	2.00E-07	per operation	Ref.: [33]
Partial failure (15mm)	4.00E-07	per operation	Ref.: [33]

6.13.1.3 The new airside vehicle filling station in the eastern support area of the expansion area and it is in close proximity of the existing two runways and the future third runway. Therefore, the potential crash impact to the station due to aircraft landing and take-off should be taken into account. The frequency of aircraft crash was estimated with reference to the research study funded by the Health and Safety Executive (UK) ^[38].

6.13.1.4 The crash frequency per unit ground area (per km²) is calculated as:

Where,

N is the number of runway movements per year

R is the probability of an accident per movement (landing or take-off)

F (x,y) is the spatial distribution of crashes

6.13.1.5 The spatial distribution of crashes can be estimated as by:

Landings

For x > -3.275 km

Take-off

For x > -0.6 km

Where,

x is the longitudinal distance between the runway threshold and the airside vehicle filling station (km)

y is the perpendicular distance between the runway threshold and the airside vehicle filling station (km)

6.13.1.6 The probability of an accident for landing is 2.7E-8 per flight and 4E-8 per flight for take-off ^[23]. Since the road tanker leaves the station after offloading the petrol, not all the flights will affect the road tanker and the flexible delivery hose. Each offloading operation takes about 20 minutes while the peak flight number per hour in 2030 is estimated to be 102, including both landings and taking-off. Assuming that all offloading operations take place during the peak hour, the total number of flights posing risk to the petrol tanker is equal to 12,410 flights (102 * 20 / 60 *365) per year.

6.13.1.7 The layout of the 3RS is shown in Figure 6‑34, with the preferred operation mode for the system to be Arrivals (A) – Departures (D) – Mixed-mode (M) to deliver the greatest capacity. This results in arrivals to the outer two runways and departures from the centre runway and one of the outer runways. A schematic diagram showing the arrival and departure routes is shown in Figure 6‑35.

Figure 6‑34: Layout of the Three Runways

Figure 6‑35: Arrival and Departure Route of 3RS

6.13.1.8 Since there are in total 8 flight routes and 12,410 flights posing risk to the petrol filling station, there are, on average, 1,551.25 flights in each route. Considering landings at the 07L, the value for x and y are 4.66 km and 1.09 km respectively. Applying the equation for spatial distribution of crashes for landings, F_L=1.33E-3. The crash frequency per unit ground area is calculated as follows:

g

6.13.1.9 The number of plane movement has been divided by 8 to take into account that half of movements are assumed to be take-off and only a quarter of landings use the runway. The area of the airside vehicle filling station is 4.5E-4 km² ^[41]. Therefore, the frequency for aircraft crash into the station with landings on the new runway is 2.51E-11 /yr. By following the same procedure, the crash frequencies for both landings and take-off can be estimated as shown in Table 6‑35.

Table 6‑35: Aircraft Crash Frequency at different Position in the Runway

Flight Routing	x (km)	y (km)	N (per year)	F (x, y)	R (per flight)	Area of Petrol Filling Station (km2)	Crash Frequency (per year)
07L - Landing	4.66	1.09	1551.25	1.33E-3	2.7E-8	4.5E-4	2.51E-11
25R - Landing	0.3	1.09	1551.25	6.76E-3	2.7E-8	4.5E-4	1.27E-10
07C - Landing	No landings at 07C						0.00E00
25C - Landing	No landings at 025C						0.00E00
07R - Landing	4.06	2.12	1551.25	2.46E-4	2.7E-8	4.5E-4	4.64E-12
25L - Landing	0.38	2.12	1551.25	9.45E-4	2.7E-8	4.5E-4	1.78E-11
07L – Take off	No take off at 07L						0.00E00
25R – Take off	No take off at 25R						0.00E00
07C - Take off	3.96	0.57	1551.25	9.43E-3	4E-8	4.5E-4	2.63E-10
25C – Take off	0.9	0.57	1551.25	3.98E-2	4E-8	4.5E-4	1.11E-9
07R – Take off	4.06	2.12	1551.25	6.25E-4	4E-8	4.5E-4	1.75E-11
25L – Take off	0.38	2.12	1551.25	2.83E-3	4E-8	4.5E-4	7.86E-11

6.13.1.10 The combined frequency of all take-off and landing crashes onto the airside vehicle filling station is 1.64E-9 /yr which is negligible as compared with the failure frequency of catastrophic road tanker failure and guillotine failure of the flexible delivery hose.

6.13.2 Event Tree Analysis

6.13.2.1 Event tree analysis (ETA) was adopted to generate the various developments, subsequent outcomes and calculations of frequency of varying consequences following an initial event/incident. The event tree of a petrol road tanker / flexible hose release is shown in Figure 6-36 and it shows that immediate ignition may lead to pool fire while delayed ignition may result in flash fire.

Figure 6‑36: Event Tree Analysis for Petrol Road Tanker/Flexible Hose Release

Table 6‑36: Probability Data for Event Tree Analysis – Airside Filling Station

Item	Value	Justification / Reference
Immediate ignition (Leak)	0.015	Ref.: 7
Delay ignition (Leak)	0.015	Ref.: 7
Immediate ignition (Rupture)	0.04	Ref.: 7
Delay ignition (Rupture)	0.04	Ref.: 7

Table 6‑37: Summary of Frequency Breakdown of Events for each Identified Scenario – Operation Phase

Scenario	Frequency (per year)
Pool fire due to catastrophic failure of atmospheric petrol tanker	5.56E-9
Flash fire due to catastrophic failure of atmospheric petrol tanker	5.56E-9
Pool fire due to partial failure of atmospheric petrol tanker	1.04E-10
Flash fire due to partial failure of atmospheric petrol tanker	1.04E-10
Pool fire due to guillotine failure of flexible delivery hose	1.10E-6
Flash fire due to guillotine failure of flexible delivery hose	1.10E-6
Pool fire due to partial failure of flexible delivery hose	2.19E-6
Flash fire due to partial failure of flexible delivery hose	2.19E-6

6.13.3 Consequence Analysis

6.13.3.1 Consequence analysis is conducted to determine the size of leakage of jet fuel and vehicle fuel under each of the identified scenarios during construction and operation phase, and the corresponding safety effects on the exposed groups of people. The following consequence models have been applied in the current study.

6.13.4 Pool Fire

Pool Fire due to Petrol Road Tanker Rupture

6.13.4.1 Pool fire occurs when a flammable liquid is spilled onto a surface followed by an ignition. In this study, pool fire effect due to the spillage of petrol will be discussed in the following sections.

6.13.4.2 Daily replenishment of petrol in the airside vehicle filling station is taking place by a road tanker which can carry a maximum of 25 m³ petrol under atmospheric pressure. In case the road tanker is ruptured, all the petrol liquid will be released and spread onto the ground to form a flammable liquid pool. A pool fire will be resulted if the liquid meets an ignition source on the way it spreads away. The probability of fatality for a person exposing to the thermal radiation generated by the pool fire can be estimated using the Eisenberg probit equation, with an assumption that the person can find a shelter at a distance of 75 m with a speed of 2.5 m/s ^[³⁰^]. With an exposure time of 30 seconds, the thermal flux levels causing 90 %, 50 % and 1 % fatality rates are 38.7 kW/m², 26.6 kW/m² and 13.4 kW/m² respectively. The size of the pool fire will be modelled using the software PHAST. The hazard distances of the petrol releases are summarised in Table 6‑38:

Table 6‑38: Hazard Distances of Petrol Pool Fire

Scenario	Harm Probability	Radiation	Weather Class
Scenario	Harm Probability	Radiation	2.5B	3D	7D	3F
Catastrophic failure of petrol tanker	0.1	13.4	37.3	37.3	37.3	37.6
	0.5	26.6	36	36	36	36
	0.9	38.7	36	36	36	36
	1	Fire Envelope	36	36	36	36
Partial failure of petrol tanker (50mm hole)	0.1	13.4	12.2	12.7	14.8	11.8
	0.5	26.6	7.5	7.6	7.9	7.4
	0.9	38.7	7	7	6.9	7.1
	1	Fire Envelope	6	6	6	6
Guillotine failure of flexible hose	0.1	13.4	16.8	17.2	17.6	16.7
	0.5	26.6	15	15	15	15
	0.9	38.7	15	15	15	15
	1	Fire Envelope	15	15	15	15
Partial failure of flexible hose (15 mm hole)	0.1	13.4	12.2	12.7	14.8	11.8
	0.5	26.6	7.5	7.6	7.9	7.4
	0.9	38.7	7	7	6.9	7.1
	1	Fire Envelope	6	6	6	6

6.13.5 Flash Fire

6.13.5.1 A flash fire is the consequence of combustion of gas cloud resulting from delayed ignition. The flammable gas cloud can be ignited at its edge and cause a flash fire of the cloud within the LFL and Upper Flammable Limit (UFL) boundaries. In case of continuous release, fire is flashed back to the release source and leads to jet fire. Major hazards from flash fire are thermal radiation and direct flame contact. Since the flash combustion of a gas cloud normally lasts for a short duration, the thermal radiation effect on people near a flash fire is limited. Humans who are encompassed outdoors by the flash fire will be fatally injured and a fatality rate of 1 is assumed. The hazard distances for petrol flash fire are shown in Table 6‑39.

Table 6‑39: Hazard Distances of Petrol Flash Fire

Scenario	Hole Size (mm)	Weather Class
		2.5B	3D	7D	2F
		Maximum Distance (m)
Catastrophic failure of petrol tanker	Rupture	118.0	122.4	120.8	126.9
Partial failure of petrol tanker	50	73.5	75.9	49.9	93.0
Guillotine failure of flexible hose	Rupture	125.2	128.8	84.8	154.6
Partial failure of flexible hose	15	73.5	75.9	49.9	93.0

6.14 Risk Results

6.14.1 Individual Risk

Construction Phase

6.14.1.1 The maximum individual risk is estimated to be 1E-8 /yr and it is shown in Figure 6‑37. The offsite individual risk is below the 1E-5 /yr criterion.

Operation Phase

6.14.1.2 During the operation phase, the maximum individual risk for the aviation fuel hydrant system is estimated to be 1E-7 /yr as shown in Figure 6‑38. The enlarged individual risk along the typical hydrant pit valves is shown in Figure 6‑39: .The maximum individual risk for the submarine pipeline is estimated to be 1E-9 /yr. The maximum individual risk for airside petrol filling station (PFS) is estimated to be 1E-6 /yr as shown in Figure 6-40. In all cases, the individual risks are below the 1E-5 /yr criterion.

6.14.1.3 Due to the close proximity of the hydrant system in the 3RS with that in the Midfield and the Terminal 1, it is necessary to estimate the cumulative individual risk level to ensure it complies with the risk guideline. The individual risk levels of the hydrant system in the Midfield and the Terminal 1 has been estimated by applying the methodology established in Section 6.12. The individual risks for both new and existing pipeline are estimated to be approximately 1E-9 /yr which is well below the individual risk criterion of 1E-5 /yr, even at the junction of the new and existing pipelines. The cumulative individual risk is shown in Figure 6‑38 which shows that there is no overlapping / cumulative risk between the new third runway hydrant system and the existing T1 & Midfield while the individual risk level for each operating system is below 1E-5.

Figure 6‑37: Individual Risk Contour for Construction Phase

Figure 6‑38: Individual Risk Contour for Hydrant System at the Third Runway (Operation Phase)

Figure 6‑39: Individual Risk Contour for a Typical Hydrant Pit Valve at a Parking Stand

Figure 6‑40: Individual Risk Contour for Airside Petrol Filling Station (Operation Phase)

6.14.2 Societal Risk

6.14.2.1 In the construction phase, total societal risk is within Acceptable region as shown in Figure 6‑41 and it is dominated by the potential tunnel construction impact to the existing submarine pipeline and underground pipeline in T1.

6.14.2.2 As shown in Figure 6-42, the total societal risk during operation phase is within ALARP region and it is dominated by the risk from the hydrant pit valve operation. Therefore, cost effective mitigation measures should be identified to reduce the risk level with particular attention on the operation of the hydrant pit valve.

Item	Mitigation Measure	Potential Benefit
Construction Phase
1	Precaution measures should be established to request barges to move away during typhoons	Prevent anchor drop / drag impact to the existing submarine jet fuel pipeline
2	An appropriate marine traffic management system should be established to minimise risk of ship collision, which could lead to sinking or dropped objects	Prevent vessel sinking to the existing submarine jet fuel pipeline
3	Location of all existing hydrant networks should be clearly identified prior to any construction works	Avoid construction damage to the existing underground jet fuel pipeline
Operation Phase
4	A similar coating standard shall be applied to the new submarine pipelines as for the existing pipelines	Minimise the chance of corrosion happening for the new submarine jet fuel pipeline
5	Checking on the integrity of the new submarine pipeline, e.g. by pigging, should be conducted during testing and commission	Identify and rectify any integrity issue with the new submarine pipeline jet fuel pipeline
6	After the fuel hydrant system is in operation, the as-built drawings of the underground jet fuel pipeline will be kept by AAHK. Before the commencement of any construction works, as-built drawings showing the alignment and level of the underground fuel pipelines for the work area will be provided to the third party construction contractors.	Prevent third party interference to the underground jet fuel pipeline
7	After the fuel hydrant system is in operation, third party construction contractors are required to undertake underground pipeline detection works to ascertain the exact alignment of the underground pipeline before the commencement of works.	Prevent third party interference to the underground jet fuel pipeline
8	Monitoring of underground pipelines by the Leak Detection System which will give signal to the operator should fuel leakage occur	Provide detection of jet fuel leakage
9	Study should be conducted to ensure the new pipeline can withstand the planned future loading.	Ensure the dynamic loading due to aircraft landing on runway will not damage the underground jet fuel pipeline
10	New pressure surge calculations are required because of the changed characteristics of the hydrant network.	Prevent abnormal pressure surge
11	There is a need to check that appropriate pressure drop calculations have been undertaken for the new system	Avoid increased pressure hazards (if increased pressure required in system to provide 9-10 bar at furthest point of third runway hydrant system)

Item No.	Mitigation Measure and the Corresponding Reason	Practicability	Implementation Cost	Risk Reduction and/or Cost Benefit Analysis	ALARP Result
1	Mitigation Measure: Maximise the use of frontal stand rather than remote stand when there are passengers onboard Reason: Passengers boarding at remote stands using mobile aircraft steps are subject to increased potential fire exposure without thermal protection (e.g. from frontal stand or aircraft fuselage structures) in case of fuel spillage with pool fire. Airbridges at the frontal stands provide better thermal protection to onboard passengers during emergency evacuation.	Allocation of parking stands is based on a principle of optimising the overall utilisation of aircraft parking facilities. In general, aircraft will be allocated frontal parking stands on a first-come-first-served basis, while aircraft operating terminating flights or long-turnaround flights with ground time exceeding 5 hours will normally be parked at remote stands. Parking stands are allocated by ACC with the stand allocation schedule issued on a bi-monthly basis. The need for aircraft refuelling with passengers onboard depends on real-time operational needs and shall be determined by the aircraft captain before the aircraft takes off. Therefore, it is considered not practicable to allocate frontal stands in advance to aircraft that requires refuelling with passengers onboard, as this is not predictable and attempting to do this would likely interfere with the overall parking stand optimisation and airport efficiency.	Not applicable	Not applicable	This measure is considered not practicable and it will not be implemented
2	Mitigation Measure: Improvement audit to reinforce existing refuelling practices and to achieve better compliance Reason: The standard ramp handling and refuelling procedures are well-established for the existing HKIA. Still, an individual’s effectiveness in preventing fuelling fires is influenced by safety awareness and understanding of fuelling operations, including facts about the prevention of fuelling fires. Improvement audit can help identifying any non-compliant activity / procedure happens during the aircraft refuelling operation, e.g. - to make sure that the aircraft refuellers are clearly instructed and properly trained for hydrant pit valve and intake coupler inspection before commencement of refuelling operation; - to make sure that the refuelling in-charge or ramp coordinator pay attention to the traffic movement around the refuelling zone throughout the aircraft refuelling process, etc.	This measure is considered practicable.	There is no cost implication.	The improvement audit can help identifying potential safety issue due to any changing working environment in the airside and prevent potential accidents from happening: - According to historical accident records at HKIA, a tractor hit the intake coupler of a dispenser vehicle on 9 May 2006 and this could have been avoided if the refueller in-charge had provided warning signal to the driver; - According to historical accident records at HKIA, leakage of 170 litres jet fuel recorded on 26 Mar 2006 could have been avoided if the aircraft refueller had checked the condition of the intake coupler before commencement of refuelling; By implementing this mitigation measure, the accidents that happened on 26 Mar 2006 and 9 May 2006 could have been avoided and the spillage frequency could be reduced from 0.23/yr to 0.156/yr, a reduction of 32 %. Since the PLL of the aircraft refuelling operation without this measure is 4.66E-5. The PLL can be reduced by 1.49E-5 (i.e. 4.66E-5 * 0.32) by this measure.	This measure is recommended
3	Mitigation Measure: Avoid aircraft refuelling with passengers onboard by sequencing refuelling before passengers boarding the plane. Reason: This measure can limit the number of persons subject to the risk of jet fuel pool fire.	It is considered not practicable to avoid this situation by sequencing refuelling before passengers boarding the plane because there is a need to top up the fuel after the take-off weight is checked and confirmed by the Captain in view of the en-route and contemporary conditions. Bulk refuelling with passengers onboard would be driven by operational need. Most of the refuelling operations are however carried out before passengers boarding the plane so that potential exposure to passengers has already been kept to as low as reasonably practicable. Please see requirements under CAD748, Clause 2.1 (Appendix 6.4)	Not applicable	Not applicable	Already implemented under CAD748
4	Mitigation Measure: During refuelling process, minimum four cones are to be put in place to indicate the refuelling zone from aircraft fuelling point for the new fuel hydrant system as far as practicable. The refueling zone is currently set at 6m radially from the aircraft fuelling point in the Airport Operations Manual (AOM) which would be subject to periodical amendments and updates to be approved by CAD. The cones serve to alert ground crew that work activities which may generate a source of ignition shall not be carried out in the refueling zone, but in no case should the cones block the exit path of the refueling vehicle so that it can leave the stand immediately in the event of emergency. AAHK will communicate this recommendation to airlines and their refuelling operators as appropriate. Proper implementation of this recommendation will be checked in AAHK’s future safety audits. Reason This measure can provide a clear indication to other ground crew members not to carry ignition source into the refuelling zone.	This measure is considered practicable.	There is no cost implication.	It is already the current practice to have the 6m refuelling zone in place while aircraft refuelling operation takes place. The mitigation measure will help ground crew members to identify the refuelling zone so that they will comply with the precaution already in place under CAD748 and AOM regulation. However, this will improve enforcement, but the risk reduction benefit cannot be quantified accurately.	Refuelling zone already implemented under CAD748 and AOM. This measure of placing cones to indicate the refuelling zone is recommended.

6.1.1.2 Besides the new aviation fuel supply system, facilities for storage of dangerous goods, such as diesel and gasoline airside vehicle refuelling station, will have to be provided in the expansion area.

6.1.1.4 The objective of the assessment is to evaluate the hazard to human life due to the following activities and hazardous provisions, and reduce the off-site risk to an As Low As Reasonably Practicable (ALARP) level:

6.1.1.5 Based on the latest scheme design, there will be no additional liquefied petroleum gas (LPG) filling station for the third runway project, hence LPG storage will not be considered in this hazard to human life assessment.

6.1.2.1 According to the EIA Study Brief No. ESB-250/2012, the scope of the assessment shall include the following:

Construction Phase: Aviation Fuel Hazards

6.1.2.2 To carry out a hazard assessment to evaluate the risk due to construction works near the existing aviation fuel pipelines and storage facilities. The hazard assessment shall include the following:

Operation Phase: Aviation Fuel Hazards

Operation Phase: Diesel and Gasoline Hazards

6.1.3.1 The individual and societal risk guideline specified in Annex 4 of the EIAO-TM will be applied in the current study.

6.1.3.3 Societal risk expresses the risks to the whole population living, working or travelling near a hazardous operation. The societal risk criteria are presented graphically on an F-N Graph as shown in Figure 6‑1.

6.1.3.4 There are three regions in the graph, namely ‘Acceptable’ region, ‘ALARP’ region and ‘Unacceptable’ region. The placement of the risk curve on the F-N graph determines what action would be required. These are defined as follows:

6.1.3.5 The societal risk criteria have integrated a vertical cut-off line at the 1,000 fatality level extending down to a frequency of 10-9/yr (1 in a billion years). Any hazardous scenario resulting in more than 1,000 fatalities will be considered as unacceptable and must be avoided.

6.2.1.1 The major tasks involved in the QRA study included hazard identification, frequency assessment, consequence modelling, risk summation and identification of mitigation measures. The details of each of the major tasks were described in the following sections.

6.2.2.1 The identification of hazardous scenarios have been achieved by conducting a review of the historical incidents occurred in HKIA and airports worldwide. The historical data can provide important information of the failure events and the associated causes for the spillage incidents.

6.2.2.5 All identified hazardous scenario(s) have been further assessed in the QRA to facilitate the computation of an event or accident frequency.

6.2.6.1 Safety measures have been identified during the HAZID workshop and cost benefit analysis would be undertaken if the risk level falls into ALARP region.

6.3.1.3 The underground pipelines are 3 m below surface and they start at the western end of the North Runway and run alongside the North Perimeter Road and South Perimeter Road before arriving at the on-airport aviation fuel tank farm.

6.3.2.1 Inside the tank farm, there are 12 cylindrical steel storage tanks with conical roofs. They have a diameter ranging from 18 m to 26 m, with a total storage capacity of 223,000 m3. The tanks are operated at atmospheric pressure.

6.3.2.2 When the fuel is transferred from the receiving facility in Sha Chau to the on-airport tank farm, it will be quarantined for 24 hours. During which fuel sample is drawn for quality check. When the fuel quality is confirmed, it is ready for use.

6.4 Existing Safety Features

6.4.1.1 As jet fuel is a flammable liquid and the fuelling operation could result in hazardous events if performed incorrectly, therefore, safety provisions are incorporated in the design of the hydrant system and safety procedures are enforced to reduce the risk of the operation.

6.4.2.1 A leak detection system is installed to monitor the pressure and temperature of the jet fuel in the hydrant system. A monthly check of any leakage in the hydrant system is carried out using the detection system.

6.4.6.1 The vehicle brake is tested before entering the aircraft parking stand and the brake is an integral part of an interlock system. The interlock system applies the vehicle brakes when any of the following occur:

6.4.8.1 During the fuelling operation at night, the hydrant pit valve and inlet hose is illuminated. Light reflective collars are attached to the inlet hose at approximately 1 m intervals.

6.4.9.1 The airport speed limit of 35 km/h at the apron is imposed. All traffic signs and signal are obeyed.

6.4.10.1 Operators are not allowed to smoke in the tank farm and during fuelling operation. “No smoking” signs is prominently displayed near the aircraft and fuelling vehicles. Currently, smoking is prohibited in all airside restricted areas.

6.4.10.2 Mobile phone is not allowed in the tank farm and apron areas.

6.4.11.1 Each hydrant dispenser vehicle is equipped with two fire extinguishers as shown in Photo 6‑8 which provide the operator an effective means to put out a small fire at the scene.

Photo 6‑1: Hydrant Dispenser Vehicle in HKIA Photo 6‑2: Delivery Hose to Aircraft Fuel Tank

6.5.1.2 All ramp activities are coordinated as efficiently as possible given the high demand for parking stands, Service provision and related resources management is done by a range of key service providers including the following:

6.5.1.4 Aircraft turnaround ramp activities are pre-planned with well established lines of communication in place between the various aircraft servicing companies, for example covering the servicing order for each aircraft.

Diversion of submarine fuel pipeline by horizontal directional drill (HDD) method

Figure 6‑8: Aviation Fuel Hydrant System Layout

6.6.5 Fuelling Operations at Apron

6.6.5.3 The aircraft fuelling operation manager will appoint a “fuelling in-charge” to supervise the fuelling procedures, coordinate with the fuelling operator and handle any irregular situations. The fuelling in-charge will ensure:

6.6.6.1 Based on the initial scheme design, it is identified that among the proposed facilities to be provided, there will be an airside vehicle filling station to be provided in the eastern support area of the expansion area [22].

6.7.3.2 The low electrical conductivity of the fuel makes it possible for static electricity to be generated and for charges to be accumulated. The degree of static charge accumulated in the fuel depends upon the following factors:

6.7.3.3 In order to reduce the accumulated amount of static electricity, antistatic additives are added to the fuel. This works by enhancing the conductivity of the fuel in order to shorten the time required for dissipating the static charge safely to earth.

6.7.3.5 Prolonged and repeated skin contact can lead to defatting of the skin, drying, cracking and dermatitis.

6.8.1.2 Compared with gasoline, diesel is less volatile due to its higher molecular weight (C13 to C25) with a high boiling point between 220 to 350 ⁰C and a high flash point around 76 ⁰C.

6.8.2.3 Diesel on the other hand does not vaporise as readily as gasoline and it is less flammable due to its high boiling and flash point.

6.8.2.4 Gasoline / diesel can float on the surface of water and may travel long distances to cause danger away from the place where it escaped.

6.8.2.5 Gasoline / diesel vapour can be harmful if inhaled to cause drowsiness and dizziness. It also irritates to both eyes and skin. Lung damage may happen if it is swallowed.

6.1.3.4
There are three regions in the graph, namely ‘Acceptable’ region, ‘ALARP’ region and ‘Unacceptable’ region. The placement of the risk curve on the F-N graph determines what action would be required. These are defined as follows:

6.1.3.5 The societal risk criteria have integrated a vertical cut-off line at the 1,000 fatality level extending down to a frequency of 10^-9/yr (1 in a billion years). Any hazardous scenario resulting in more than 1,000 fatalities will be considered as unacceptable and must be avoided.

6.3.2.1 Inside the tank farm, there are 12 cylindrical steel storage tanks with conical roofs. They have a diameter ranging from 18 m to 26 m, with a total storage capacity of 223,000 m³. The tanks are operated at atmospheric pressure.

6.6.6.1 Based on the initial scheme design, it is identified that among the proposed facilities to be provided, there will be an airside vehicle filling station to be provided in the eastern support area of the expansion area ^[22].